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EXAMINING THE CONSUMER FINANCIAL 
PROTECTION BUREAU’S MASS DATA 
COLLECTION PROGRAM 


Wednesday, December 16, 2015 

U.S. House of Representatives, 

Subcommittee on Oversight 
AND Investigations, 
Committee on Financial Services, 

Washington, D.C. 

The subcommittee met, pursuant to notice, at 11:03 a.m., in room 
2128, Rayburn House Office Building, Hon. Sean P. Duffy [chair- 
man of the subcommittee] presiding. 

Members present: Representatives Duffy, Fitzpatrick, Fincher, 
Hultgren, Tipton, Poliquin, Hill; Green, Cleaver, Ellison, Beatty, 
Sinema, and Vargas. 

Ex officio present: Representative Waters. 

Also present: Representative Love. 

Chairman Duffy. The Oversight and Investigations Sub- 
committee will come to order. 

The title of today’s subcommittee hearing is, “Examining the 
Consumer Financial Protection Bureau’s Mass Data Collection Pro- 
gram.” 

Without objection, the Chair is authorized to declare a recess of 
the subcommittee at any time. 

The Chair now recognizes himself for 4 minutes to give an open- 
ing statement. 

The Consumer Financial Protection Bureau (CFPB) is fundamen- 
tally tasked with protecting Americans from unfair, deceptive, and 
abusive financial practices. Ironically, as a result of its massive 
data collection activities, the CFPB is putting all Americans, all of 
us, at risk. 

From January 2012 to July of 2014, the CFPB carried out 12 
large-scale data collections, including the monthly collection of data 
affecting hundreds of millions of credit card accounts, 173 million 
mortgages, as well as information on 10.7 million consumer credit 
reports. Five of these data collections are ongoing. 

Not a day goes by that Americans are not made aware of yet an- 
other breach of their sensitive information. Whether it is in the 
public or private sector, vast collections of personal consumer data 
are prime targets for cyber attackers. 

Aside from the fact that the CFPB does not need to be collecting 
these vast amounts of information to carry out its regulatory mis- 
sion, it is troubling that it has not taken more appropriate steps 

( 1 ) 
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to secure this data. In fact, before this committee last year, CFPB 
Director Cordray said that he could not rule out the potential for 
a data breach at the Bureau. 

We now know — and the American people don’t know — how much 
personally identifiable information, or PII, the CFPB retains, how 
that data is protected, and what the Bureau plans to do with all 
that data. 

And while the CFPB claims that it collects very little data that 
contains PII, collecting non-PII data may also endanger consumers. 
A recent study published by an MIT-led team of researchers found 
that knowing just four pieces — four pieces — of information about a 
person’s credit card transactions was enough to re-identify the 
anonymous credit card data in 90 percent of the cases that they 
studied. 

The Dodd-Frank Act granted the CFPB expansive and intrusive 
authority with veiy little accountability or oversight. However, 
CFPB’s data collection programs appear to exceed the mandates in- 
cluded in Dodd-Frank. Under the guise of its supervisory, moni- 
toring, and examination authorities, the CFPB appears to have 
subordinated consumers’ interests with its data collection pro- 
grams. 

What is more concerning is that while the CFPB claims to be an 
information-driven agency, it seems to cherry-pick data to justify 
pursuing a politicized rulemaking agenda. From publishing 
unverified consumer complaints on its website to using unreliable 
methodologies for estimating race in auto lending ECOA actions, 
the agency has proven time and time again that it will present only 
the most convenient of “facts” for its purposes. 

Manipulating data to validate a regulatory outcome is not sound 
public policy. This is junk science. The CFPB should focus on re- 
sponding to actual allegations of consumer fraud and discrimina- 
tion rather than collecting data for the purposes of undertaking 
costly and abusive phishing expeditions. 

I welcome our panel of witnesses here today, and I look forward 
to hearing from them as they present their testimony. 

I now yield 5 minutes to the gentleman from Texas, the ranking 
member of the subcommittee, Mr. Green, for his opening state- 
ment. 

Mr. Green. Thank you very much, Mr. Chairman. 

I would like to thank the witnesses for appearing. 

And I would like to acknowledge the presence of the Honorable 
former Speaker of the House. And for our purposes today, because 
he was the Speaker, I shall refer to him as “Mr. Speaker.” 

I am, Mr. Chairman, antithetical to most of what you said, and 
I am also concerned about something that has occurred. 

Mr. Speaker, we — or someone owes you an apology. And someone 
owes you an apology because on the memos that I have received 
and on the witness list, you are acknowledged as the former Speak- 
er of the House — as indeed, you should be — but there is no ac- 
knowledgement of your affiliation with the U.S. Consumer Coali- 
tion. And, generally speaking, this is what we do here. 

I have a document that I shall ask unanimous consent to be 
placed in the record. 

Chairman Duffy. Without objection, it is so ordered. 
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Mr. Green. This document is dated July 23 , 2015, from the Fi- 
nancial Services majority staff, and it is to the members of the 
committee, styled, “The Dodd-Frank Act Five Years Later.” And it 
indicates that we are having the Honorable Phil Gramm appear, 
and the case that he was a senior partner at U.S. Policy Metrics, 
and that he is a former United States Senator; Honorable R. Brad- 
ley Miller, of counsel with Grais & Ellsworth LLP, and former 
Member of Congress. 

So I am going to ask unanimous consent that the record be cor- 
rected so that it will be indicated on the memo and the witness list 
that you are, Mr. Speaker, associated with the U.S. Consumer Coa- 
lition. 

I ask unanimous consent. 

Chairman Duffy. If that is the case, without objection, it is so 
ordered. 

Mr. Green. I would also indicate why I have done this, Mr. 
Chairman. 

I perused quite a few articles concerning this Coalition, this 
group. It appears to be a corporate-owned and -subsidized synthetic 
grassroots organization. The activists, consumer organizations, 
know very little about it. It is a 501(c)(4). There is no way to ascer- 
tain who really funds it. And I think it is very important for us to 
know who is really coming after the CFPB. This organization has 
a mission statement that coincides with much of what has occurred 
here in the Congress of the United States of America. 

I am going to have to yield some time to the ranking member, 
but I think it is important for us to go into this. I have several arti- 
cles that I will be introducing into the record. 

And having perused the Speaker’s statement for today, I am 
going to assume that it is just an oversight, because nowhere in the 
statement does it indicate his affiliation with the U.S. Consumer 
Coalition. 

This oversight has occurred more than once, because it appears 
that The Wall Street Journal had to issue an amplification as a re- 
sult. This is something that has been called to our attention by vir- 
tue of various sources, one being Media Matters. 

So, with this, I will now yield the rest, remainder, and residue 
of my time to the ranking member of the full Financial Services 
Committee, Ranking Member Waters. 

Ms. Waters. Thank you very much. I appreciate the time. 

As we sit here today to talk about the CFPB’s data collection 
practices, the CFPB uses the data it collects to ensure that poten- 
tially harmful products do not permeate the market, to inform the 
agency’s rulemaking efforts, to conduct critical supervisory over- 
sight, and to return money to consumers who have been harmed. 

Unfortunately, my colleagues across the aisle are not here today 
to discuss data collection practices. Instead, this hearing is simply 
another blatant attempt to mischaracterize the Bureau’s data col- 
lection activities as harmful to consumers. 

How do we know this? Because the chairman of this committee, 
Mr. Hensarling, previously sponsored the PATH Act, a bill that, if 
enacted, would have authorized the creation of a national mortgage 
data repository that would collect the same individualized, person- 
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alized data that Republicans shame the CFPB for collecting, and 
which is the subject of this very hearing. 

Currently, most of the data that the CFPB collects is public and 
nonpersonally identifiable. Both the GAO and the CFPB Inspector 
General have indicated that the CFPB is generally in compliance 
with data privacy and security laws. 

Nevertheless, my Republican colleagues are here today to, again, 
criticize and undermine an agency that has returned more than 
$11 billion to 25 million Americans. 

I yield back. 

Chairman Duffy. The gentlelady yields back time she does not 
have. 

The Chair now recognizes the vice chairman of the sub- 
committee, the gentleman from Pennsylvania, Mr. Fitzpatrick, for 
1 minute for an opening statement. 

Mr. Fitzpatrick. Thank you, Mr. Chairman, for the hearing. 

And welcome to the witnesses this morning. 

Increasingly, our cyber infrastructure and private records are be- 
coming targets of both state and non-state actors alike. I don’t have 
to remind everyone here about the theft of personal information 
from the Office of Personnel Management — I suspect we all re- 
ceived that letter — or any of the other significant breaches of con- 
sumer data that have occurred. 

For these reasons, it is alarming that any organization, espe- 
cially an agency of the Federal Government of the United States, 
would collect consumer data and store it in a single location, as the 
Consumer Financial Protection Bureau does, especially when, ac- 
cording to a GAO study, the CFPB lacks procedures and docu- 
mentation for these collecting practices or security protocols to 
store private consumer information in a manner safe from hackers. 

What’s more, it seems that no type of data is off limits to the 
CFPB. While Congress has not been provided a complete picture of 
these actions, we know that one of these mass collections yielded 
data on 173 million loans. 

So we look forward to the hearing, today’s witness testimony, 
and we hope that it allows all of us to develop a better under- 
standing of this practice and if there is a reason or legitimate need 
for these aggressive Federal practices to continue. 

I yield back. 

Chairman Duffy. The gentleman yields back. 

I now want to welcome our witnesses. 

And because I do want to at one point get to our testimony, I am 
not going to spend an hour relating all of the things that Speaker 
Gingrich has done. What I have realized recently, though, is that 
he is a fiction author; he wrote a great book, which my wife just 
completed. It is a page-turner. I didn’t realize that. But I am going 
to stick to the basics. He was elected to Congress in 1978 from the 
Sixth District of Georgia and, as we all know, was the Speaker of 
the House from 1995 through 1998. 

Speaker Gingrich, welcome, and thank you for being here. 

I also want to welcome Mr. Wayne Abernathy. He is the execu- 
tive vice president for financial institutions policy and regulatory 
affairs at the American Bankers Association. Welcome. 
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Dr. Calabria, welcome again. Dr. Calabria is the director of fi- 
nancial regulation studies at the Cato Institute. 

And finally last, but not least, Mr. Deepak Gupta is the founding 
principal of Gupta Wessler, an appellate litigation boutique in 
Washington, D.C. 

Welcome, panel. 

Each of you are going to be recognized for 5 minutes to give an 
oral presentation of your testimony. 

And without objection, your written statements will be made a 
part of the record. Once the witnesses have finished presenting 
their testimony, each member of the subcommittee will have 5 min- 
utes within which to ask the panel questions. 

Just as a reminder — many of you know this — on the table you 
have three lights: green means go; yellow means you have a minute 
left; and red means your time is up. I would just note that if you 
get a question while your light is yellow, I will give you the leni- 
ency to finish your question as it goes into red, but please don’t go 
on for a minute or two. Otherwise, I will just start tapping my 
gavel, and we will try to wrap it up. 

And with that. Speaker Gingrich, welcome, and you are now rec- 
ognized for your 5-minute presentation. 

STATEMENT OF THE HONORABLE NEWT GINGRICH, FORMER 
SPEAKER, U.S. HOUSE OF REPRESENTATIVES 

Mr. Gingrich. Good morning, and thank you for allowing me to 
be here. It is an honor to be with you on this important issue. 

I do want to say about Mr. Green’s concern that if either he or 
his staff had read my testimony, they would find that on page 3, 
I describe my relationship as an adviser to the U.S. Consumer Coa- 
lition. 

But the subject of today’s hearing is important in a narrow 
sense, in that we have an agency that is collecting more informa- 
tion about Americans’ private lives than any bureaucracy deserves, 
for reasons unrelated to national security. 

But it is also important in a broader sense. Today, the Consumer 
Financial Protection Bureau is so far outside the historic American 
system of constitutionally limited government and the rule of law 
that it is the perfect case study of the pathologies that infect our 
bureaucracies at the Federal level. It is dictatorial. It is unaccount- 
able. It is practically unrestrained and expanding on its already ex- 
pansive mandate from Congress. And it is contemptuous of the 
rights, values, and preferences of ordinary Americans. 

The CFPB is all of these things, as are many of our large, de- 
structive bureaucracies in this City — a huge problem in its own 
right. But the CFPB is an especially good symbol of these 
pathologies because of its unique structure among regulatory agen- 
cies. 

In the Dodd-Frank Wall Street Reform and Consumer Protection 
Act that created the Bureau, Congress — ^very unwisely, in my opin- 
ion — gave up two of its core constitutional powers for reining in Ex- 
ecutive Branch agencies. 

First, the CFPB is not subject to the annual congressional appro- 
priations process and instead is funded out of a fixed portion of the 
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Federal Reserve’s budget. So, in effect, you have a bureaucratic 
slush fund that is self-defined by the bureaucracies on their behalf. 

Second, its Director can be fired only by the President and then 
only under limited circumstances because Dodd-Frank protects him 
from being removed by Congress. 

For all practical purposes, this means the bureaucracy is free to 
do whatever it wants within the broadest imaginable interpretation 
of its authority without fear of losing its funding or its leadership. 
This is a very dangerous recipe for petty dictatorship and is com- 
pletely foreign to the American model. 

I always remind people of Lord Acton’s famous dictum: “Power 
tends to corrupt. Absolute power corrupts absolutely.” Notice he 
drops the “tends.” There is no better example of the corruption of 
power than this agency, which is totally secret, totally unaccount- 
able, spends a vast amount of money, has huge cost overruns, and 
is doing whatever it wants to whomever it feels like doing it to. 

We know this formula is dangerous because we have watched the 
Bureau’s behavior over the past 4 years. We have seen the con- 
tempt with which it treats Congress and the American people. 

The CFPB is prohibited from regulating car dealers, but it has 
done so anyway, using absurdly inaccurate techniques — which, by 
the way, in the private sector would lead to lawsuits over fraud — 
to accuse them of racial discrimination and extract fines from car 
companies and auto finance companies. This says your government 
is a bully and your government is a blackmailer. 

The topic of this hearing is another good example of the CFPB’s 
overreach, one I also discussed in my own article in The Wall 
Street Journal last summer. The CFPB is prohibited in Section 
1022 of Dodd-Frank from collecting personally identifiable informa- 
tion on Americans, but the Bureau is doing so anyway. And it is 
doing so on a massive scale that rivals the NSA’s most controver- 
sial collection programs but for much less compelling reasons. 

The CFPB has said it aims to monitor at least 95 percent of all 
credit card transactions in the United States by 2016. Toward that 
end, the Bureau is already collecting and analyzing data from at 
least 600 million credit card accounts each month. That is 7 billion 
records in the last year alone. 

And it is not just credit card data. The CFPB is gathering data 
on 22 million private-label mortgages every month, 5.5 million stu- 
dent loans, 2 million bank accounts with overdraft fees, and on 
hundreds of thousands of auto sales, credit scores, and deposit ad- 
vance loans. 

These secretive and intrusive data-gathering operations are tak- 
ing place without consumers’ knowledge and without the ability for 
consumers to opt out. Unless they have been tuned in to occasional 
congressional oversight hearings like this one, consumers are en- 
tirely unaware that government bureaucrats are poring over their 
credit card transactions every month looking for new products to 
regulate. 

The CFPB is scooping up more information about law-abiding 
Americans than any government agency should be permitted to col- 
lect for reasons unrelated to national security or law enforcement. 

In fact, in a recent poll conducted by Zogby for the U.S. Con- 
sumer Coalition, which I happen to advise — let me repeat that. 
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since it is in the record, but I just want to make sure for particu- 
larly Mr. Green’s staff that they get it — which I happen to advise — 
so I am not secret about the relationship — just one in five Ameri- 
cans said they believe the CFPB should be allowed to gather credit 
card statements without consumers’ knowledge. 

For those of you who are concerned about the intelligence com- 
munity’s direct data collection effort, I don’t see how you can be 
worried about the potential for abuse and about the, in fact, justi- 
fied lack of transparency in national security agencies and not be 
concerned about the same dangers in this large and unaccountable 
bureaucracy armed with similar kinds of information. 

Think of the absurdity of being told that Homeland Security will 
not look at Facebook pages of foreigners out of concern for their 
privacy while CFPB is gathering up all of this data. Let me just 
say, certainly, if the NSA and the FBI need a warrant to collect 
such data on U.S. citizens for the purpose of preventing terrorism, 
the CFPB should need to get a warrant, too. 

In closing, what we have in the CFPB is an agency that is not 
accountable to Congress or the American people, an agency that is 
stretching the boundaries of its authority as far as it can, and a 
bureaucracy which for all practical purposes is out of control. As 
the American people’s elected Representatives in Congress, this 
should bother you no matter which side of the aisle you are on and 
whatever you think of the Bureau’s preferred regulations. 

It is imperative that we move toward abolishing the Consumer 
Financial Protection Bureau and, at the very least, subject it to an 
annual budgeting and appropriations process, in addition to re- 
structuring its leadership to make sure it is accountable to Con- 
gress. 

Thank you, and I look forward to your questions. 

[The prepared statement of Speaker Gingrich can be found on 
page 67 of the appendix.] 

Chairman Duffy. Mr. Abernathy, you are recognized for 5 min- 
utes. 

STATEMENT OF WAYNE A. ABERNATHY, EXECUTIVE VICE 

PRESIDENT FOR FINANCIAL INSTITUTIONS POLICY AND 

REGULATORY AFFAIRS, AMERICAN BANKERS ASSOCIATION 

Mr. Abernathy. Thank you. Chairman Duffy and Ranking Mem- 
ber Green, for this opportunity to testify. My name is Wayne Aber- 
nathy. I am executive vice president at the American Bankers As- 
sociation (ABA). 

The customers of ABA’s thousands of member banks are affected 
by the actions, policies, and decisions of the CFPB. The Bureau has 
enormous authority over retail financial products and those who 
provide them, and, therefore, over the people who use them. 

This power comes with little more than nominal oversight and 
accountability. It would be hard to find a Federal agency where the 
gap between regulatory power and public accountability is greater. 

Bureau officials repeatedly assert that the Bureau is a trans- 
parent and data-driven agency. Public exposure and data are to be 
the checks on the natural tendency for any such agency to stray 
into arbitrary action. 
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I emphasize the Bureau is governed by one person. No one in the 
agency can address him without ultimately bending to that one 
person’s policy judgment, knowing that at some point in the discus- 
sion it will end with, “Yes, sir.” 

We welcome this subcommittee’s inquiry into the question of how 
strong a check on arbitrary behavior are the Bureau’s data policies 
and practices. How much is the Bureau, in fact, data-driven? And 
by which data? From which sources? And how would we know? 

Bureau Director Richard Cordray stated the following: “At the 
Consumer Bureau, we are a data-driven agency. The best decisions 
will be those that are best informed.” 

The Bureau’s strategic plan for Fiscal Years 2013 through 2017 
includes the following: “We take in data, manage it, store it, share 
it appropriately, and protect it from unauthorized access.” 

And then this from the Bureau’s website on a page titled, “Open 
Government”: “Transparency is at the core of our agenda, and it is 
a key part of how we operate.” 

We support those statements. Bureau practices, however, have 
not lived up to these standards, and there is little to require that 
they do so. The Dodd-Frank Act extends to the Bureau impressive 
authorities for requiring information. The Act’s oversight structure 
is much less impressive. 

Problematic Bureau data practices have undermined the effective 
use of data to serve as a check on arbitrary action and weakened 
the quality of policymaking, placing at risk the Bureau’s mission to 
protect consumers. In my written statement, I discuss several ex- 
amples, which I will merely list for you at this point. 

The Bureau evades public disclosure laws, such as the Paper- 
work Reduction Act, while cherry-picking data. In selective data 
samples, the Bureau skews results, mischaracterizing consumer 
markets. The Bureau has misrepresented its data gathering on 
overdrafts. On its website, the Bureau publishes unverified com- 
plaint information. In its arbitration study, the Bureau ignores its 
own data. To promote its policies on indirect auto lending, the Bu- 
reau has manufactured data that do no exist. 

I will explain briefly one of these as an example, the unverified 
complaint information. 

The Bureau publishes on its official website, at the top of which 
are the words, “An official website of the United States Govern- 
ment,” they publish consumer complaints that are unverified for 
accuracy or veracity. 

The Bureau asserts that, “by adding their voice, consumers help 
improve the financial marketplace.” But how can this be true if the 
information provided is unreliable and misleading? What does the 
Bureau offer to protect a consumer from acting on erroneous infor- 
mation published on the Bureau’s own website? 

ABA offers four recommendations in our written statement. I 
would emphasize our fourth. The governance of the Bureau should 
be changed from a sole directorship to governance by a bipartisan 
commission. With a bipartisan structure, we gain light from a vari- 
ety of viewpoints, different people posing different questions from 
different backgrounds, all more likely to poke and prod the data, 
and all of them likely to be intolerant of information legerdemain. 
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On behalf of ABA and its member banks of all business models, 
serving hundreds of millions of people, our customers and your con- 
stituents impacted by Bureau decisions by the Consumer Bureau, 
I want to thank this subcommittee for this very important inquiry. 
I would be happy to respond to any questions you may have. 

[The prepared statement of Mr. Abernathy can be found on page 
44 of the appendix.] 

Chairman Duffy. Thank you. 

Dr. Calabria, you are recognized for 5 minutes. 

STATEMENT OF MARK A. CALABRIA, DIRECTOR, FINANCIAL 
REGULATION STUDIES, CATO INSTITUTE 

Mr. Calabria. Chairman Duffy, Ranking Member Green, and 
distinguished members of the subcommittee, I thank you for the in- 
vitation to appear at today’s important hearing. 

Let me first say that the concerns I will raise are not unique to 
the CFPB. They apply across the Federal Government. 

Let me also note that my colleagues and I at the Cato Institute 
have consistently raised these concerns regardless of politics or the 
mission of the agency. We have been vocal, highlighting abuses in 
law enforcement and national security. I would go so far as to say 
we have spent considerable resources trying to undo the third- 
party doctrine, which is the basis of almost all Federal surveil- 
lance. 

So, again, this is not something new to us. In fact, we have spent 
more time on the PATRIOT Act and the Bank Secrecy Act than we 
have on surveillance at the Consumer Financial Protection Bureau. 
So, again, this is not something new for us. 

Let me also say, as I detail in my testimony, the massive data 
collection at the CFPB is one of choice. There is no explicit man- 
date or requirement for this level of data collection. As someone 
who has previously managed one of the offices that have been 
transferred to the CFPB, I can say that the extent of this data col- 
lection is also unnecessary for it to fulfill its responsibilities. 

During my tenure enforcing the Real Estate Settlement Proce- 
dures Act at HUD, we nearly doubled enforcement, significantly in- 
creased enforcement action, and we did so without having to resort 
to a massive dragnet of consumer data. 

Obviously and unfortunately, some of those actions did not pre- 
vent the financial crisis, but I would have told you then, as I will 
tell you today, the problems with RESPA and much of our con- 
sumer financial protection are in the underlying statutes — which I 
greatly encourage Congress to revisit — not from a lack of surveil- 
lance. 

We have seen this play out in the area of national security, 
where the public is repeatedly told that if only we had more data, 
various attacks would have been avoided. Yet, repeatedly, the intel- 
ligence failures we witness are not from a lack of data. They are 
from an inability or unwillingness to connect the dots. 

Similarly, the financial crisis was met with demands for more 
data, as if the overheated housing and mortgage markets were not 
obvious enough from the aggregate data. They were obvious to me 
over a decade ago. Unfortunately, our regulators ignored them. 
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And, of course, more data does not necessarily help you if you con- 
tinue to ignore it. 

The CFPB has not been immune from this false idol of more 
data. As the GAO has reported, the CFPB has engaged in at least 
12 large-scale data collection efforts. At least three of these include 
information that directly identifies individual consumers. Com- 
bining this information with other sources, such as the other nine, 
could allow the information also to be identified on consumers. In 
my opinion — granted, as a nonlawyer — I believe these collections do 
not comply fully with the Right to Financial Privacy Act. 

Let me also state, as a former Federal employee and one subject 
to the recent 0PM breach, I don’t trust any part of the government 
with my data, the CFPB or otherwise. In consolidating all of this 
financial information in one place, the CFPB has left consumers ex- 
tremely vulnerable to hackers and identity theft. 

Those are only threats from outside the Bureau. Unfortunately, 
the CFPB’s data collection, in my opinion, also poses significant 
threats to our Fourth Amendment protections, which I believe 
apply to everybody, even financial service providers. As Justice 
Douglas observed in his dissent to the California Bankers case, “A 
checking account may well record a citizen’s activities, opinions, 
and beliefs as fully as the transcripts of his telephone records.” 
Credit cards are today’s checks. 

Such concerns are not simply reflections of the Watergate era. As 
recently as 2012, Justice Sotomayor, in her concurrence to United 
States V. Antoine Jones, correctly observed, “Awareness that the 
government may be watching chills association and expressive free- 
doms. The government’s unrestrained power to assemble data that 
reveal private aspects of identity is susceptible to abuse.” Those are 
Justice Sotomayor’s words, not mine. 

Justice Sotomayor offers the example of medications purchased 
online by online retailers. Such a purchase could theoretically be 
identified within the CFPB’s data card collections. 

For a variety of reasons, as I think this hearing has dem- 
onstrated across the aisle, the CFPB has become a highly partisan 
issue. I think that is unfortunate. Were it to use the financial 
records of its critics as an attempt to silence and intimidate those 
critics, it would not be the first agency to do so. And as an insti- 
tute, at the Cato Institute, where we receive our donations via 
credit card, this is a very real risk and certainly one that we worry 
about. 

I will only quote Justice Thurgood Marshall, who sadly observed, 
“The technique of examining bank records to investigate political 
organizations is, unfortunately, not a rare one.” And as someone at 
the Cato Institute who regularly takes a stand that is occasionally 
unpopular in Washington, I certainly share in this concern. 

My suggestion would be that the CFPB end these data collec- 
tions. I would submit that there is more than enough work to do 
actually responding to consumer complaints. 

I thank the subcommittee for their time, and I look forward to 
your questions. 

[The prepared statement of Dr. Calabria can be found on page 
55 of the appendix.] 
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Chairman Duffy. Mr. Gupta, you are now recognized for 5 min- 
utes for a summary of your opening statement. 

STATEMENT OF DEEPAK GUPTA, FOUNDING PRINCIPAL, 
GUPTA WESSLER PLLC 

Mr. Gupta. Thank you, Chairman Duffy, and Ranking Member 
Green. 

I will make three points this morning based on my perspective 
as a former CFPB official and as an advocate for consumers, in- 
cluding in data privacy cases. 

First, privacy and the security of consumer data are important 
issues, and if this subcommittee were really concerned, there are 
real problems it could be addressing. There have been major data 
breaches recently in which credit card information was stolen from 
consumers at Target and Home Depot, for example. 

But this subcommittee hasn’t held a single hearing on those real- 
world threats. Instead, we are having a hearing about a set of 
imagined problems that exist only in the minds of the CFPB’s polit- 
ical opponents. 

In fact, if you ask the actual consumer privacy groups, they voice 
support for the CFPB’s data collection efforts. And I believe there 
is a statement that has been entered into the record today, or will 
be — As one privacy advocate put it, “The reason you don’t hear 
from privacy or consumer groups is that the CFPB is not doing 
anything that concerns us, nor, for that matter, is it doing much 
differently than other regulators have always done.” 

Second, to the extent that it is doing anything different, the Bu- 
reau’s collection of data is creating the kind of oversight and con- 
sumer protection that were missing before the financial crisis. 

For example, the compilation of anonymous account-level data — 
I want to stress that; it is anonymous account-level data — from the 
CFPB’s credit card database has allowed the Bureau to study im- 
portant topics, such as credit card marketing practices and the 
widespread use of forced arbitration clauses in consumer contracts, 
something Congress required the CFPB to study. 

Data collection is crucial to the Bureau’s ability to identify sys- 
temic violations of consumer laws, discrepancies in credit score re- 
porting, and harmful effects of checking account overdraft pro- 
grams, to name just a few examples. 

The CFPB’s data collection ensures that the agency’s regulation 
and enforcement are data-driven — that is, based on the best under- 
standing of market trends and empirical reality. That is the whole 
point of having expert administrative agencies in the first place. So 
unless your profits come from deceiving consumers, you should wel- 
come the CFPB’s data collection. 

Third and finally, the very existence of this hearing illustrates 
one danger that can occur when public officials don’t base their ac- 
tions on data. We have a made-up controversy, unfortunately, 
based on made-up facts. 

The CFPB is not spying on American citizens. It is not the NSA. 
It is not interested in the details of people’s personal activities, nor 
would the data that the agency is currently collecting enable it to 
investigate those activities even if it were interested in, say, what 
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you plan to buy tomorrow with your credit card for a Christmas 
present for your grandmother. 

In fact, the vast majority of the data collected by the CFPB is 
already public, such as data on mortgages already recorded in local 
land records or auto sales on record with the DMV. And most of 
it is aggregate data at the account level, not at the transaction 
level, designed to give the agency a picture of what financial insti- 
tutions, not individual consumers, are up to. 

The GAO looked into this controversy and, in a detailed review, 
found that none of the major problems that the CFPB’s opponents 
have alleged exist. Of the 12 major projects analyzed by the GAO, 
only 3 even potentially involved any personal consumer data, and 
the GAO found that the CFPB had taken steps to protect and se- 
cure the data it collects, and it has a system for anonymizing any 
material involving identifying information. 

And I want to correct one factual inaccuracy that I have heard 
several times already this morning. None of the ongoing data col- 
lections by the CFPB contains personally identifiable information. 
That is a fact that has been verified by the GAO. Agencies have 
been collecting this same stuff for years and nobody has com- 
plained, GAO also found. 

The story with consumer complaint data is similar. The Inspector 
General did an exhaustive review and uncovered no major prob- 
lems. Of the 250,000 complaints examined, the IG’s audit found an 
accuracy rate of 99.99 percent, an error rate of 0.01 percent. I wish 
that most of the work product that emanated from this building, 
for example, could meet that accuracy standard. 

Meanwhile, the financial industry is collecting far more person- 
ally identifiable data that could open up real questions about con- 
sumer privacy. The JPMorgan Chase Institute, for example, re- 
cently released a report that pulled from a data set of 12 billion 
individual consumer transactions. 

So if we are really worried about the collection of this kind of 
data, we should be far more concerned about the private market 
that is developing for this data. And with all the real problems in 
consumer finance, I think it is unfortunate that the subcommittee 
feels the need to hold a hearing today on this nonissue. 

Thank you for inviting me to testify, and I am happy to answer 
any questions. 

[The prepared statement of Mr. Gupta can be found on page 71 
of the appendix.] 

Chairman Duffy. Thank you, panel. 

The Chair now recognizes the vice chairman of the sub- 
committee, the gentleman from Pennsylvania, Mr. Fitzpatrick, for 
5 minutes for questions. 

Mr. Fitzpatrick. Thank you. Chairman Duffy, for calling this 
hearing. The hearing is critically important, given all the security 
breaches that we have been hearing about and reading about, not 
only in the private sector of the economy, from retailers, but, most 
importantly, in the public sector. 

And, in most of those cases, the average American citizen does 
not know that their information is being collected by the Federal 
Government or that their security has been breached. They just 
don’t know that. 
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Speaker Gingrich, you talked about the two Constitutional provi- 
sions that the United States Congress essentially walked away 
from in passing Dodd-Frank and creating the CFPB. And then you 
testified about all the personally identifiable information that the 
CFPB is collecting. 

I have two questions. First, are you concerned about the CFPB’s 
ability to protect and secure that information from breaches? 

And second, when you have an agency of the Federal Govern- 
ment that essentially lacks accountability or oversight from the 
Congress, what is the interest or the vigilance that the agency 
would have to actually get down and protect that information? So 
how is the CFPB different than other agencies? 

Mr. Gingrich. Thank you for the question. 

Let me say, first of all, anybody who believes that anyone has 
the ability to guarantee security of information is totally out of 
touch with the real world. When you look at the size of the 
breaches and you look at the number of hackers around the planet 
and you look at the intensity with which people are trying to figure 
out how to do this, there is no place where you are going to aggre- 
gate information, unless you take it totally offline, that you are 
going to have real, true security. 

These systems are growing very rapidly. They are getting much 
more sophisticated, and we are going to be in a very different 
world. It is like the Wild West. This is not like 10 years ago. And 
it is going to get worse. 

Second, I want to point out that in The Wall Street Journal arti- 
cle I cited a Stanford study on how to take metadata from tele- 
phones and connect them to get individual identity, and an MIT 
study for how to do that with credit cards. So when people say to 
you, oh, we are only gathering impersonal information, the fact is 
that is a sign they don’t understand how big data has evolved and 
the fact that you can reassess and redefine people if you have 
enough data points. 

So I find it much more frightening to have government bureauc- 
racies that are uncontrolled having that level of information and 
power. In the private sector, if I don’t like a company, I can quit. 
That isn’t how it works if you are a citizen and two bureaucrats 
show up at your front door. 

Mr. Fitzpatrick. Mr. Gupta, if a constituent of mine in Bucks 
County, Pennsylvania, had her personal information or her finan- 
cial habits stolen in a data breach of the CFPB, how would you ex- 
plain to her that it was necessary for the Federal Government to 
collect and store this information in the first place? 

Mr. Gupta. I would first explain to her that the whole premise 
of the question is false, because, as I said, none of the ongoing col- 
lection efforts by the CFPB involve any personally identifiable in- 
formation. 

And that is verified by the GAO report, and it is pursuant to the 
statutory authority. The authority that this Congress gave the 
CFPB to do ongoing market monitoring expressly comes with a lim- 
itation which says that data cannot include personally identifiable 
information. And the CFPB, the GAO found, is complying with that 
mandate. 
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So, to the extent there is any personally identifiable information, 
it is either going to be because she provided it as part of a con- 
sumer complaint and that information is not going to be informa- 
tion that would be damaging; it would be information that allows 
the agency to get in touch with her — or, for example, when there 
is supervision and enforcement and the agency needs the person’s 
contact information to get in touch with them to reimburse them 
if they have been defrauded. But those are really small exceptions. 

Mr. Fitzpatrick. Dr. Calabria, do you concur that my con- 
stituent should have no concern with what the CFPB holds? 

Mr. Calabria. I do not concur. Maybe I need to reread the GAO 
report a few times, but my read of it is pretty clear that at least 
three of those programs do have personally identifiable informa- 
tion. 

And there is also a question of, can you take the information in 
those programs and link to other programs that aren’t personally 
identifiable, and I think that there is a very real risk there. 

Again, as I noted in my testimony, I was a victim of the 0PM 
breach. And I am very touched that 0PM has now made sure that 
I get at least a year of credit check free. That is very touching. I 
would personally like the Chinese to give me my information back 
and not to use it. It is kind of hard to close that barn door after 
the horse is out. 

So I think we need to be thinking ahead of time. The time to 
react is not after the breaches; the point to react is to not collect 
this level of data if you don’t need it to begin with. 

Mr. Fitzpatrick. I think most of us who also were victims of 
those same breach would agree with you. Dr. Calabria. 

Thank you. I yield back. 

Chairman Duffy. The gentleman yields back. 

The Chair now recognizes the ranking member of the full Finan- 
cial Services Committee, Ms. Waters, for 5 minutes. 

Ms. Waters. Thank you very much. 

Let me welcome all of our panelists here today, and especially 
Speaker Gingrich. Welcome, welcome, welcome. 

Speaker Gingrich, whom are you representing here today? 

Mr. Gingrich. I represent myself. 

Ms. Waters. What is the name of the PR firm that you work for? 

Mr. Gingrich. The U.S. Consumer Coalition is not a PR firm. It 
is an organization which has been raising questions. I work with 
them. I have said that publicly. I said it, in fact, in the testimony 
we submitted here. And I think the questions they raise are very 
good ones. 

But my view — 

Ms. Waters. The Coalition — 

Mr. Gingrich. — is not shaped by that. I am a conservative — 

Ms. Waters. Excuse me. I am not interested in that right now, 
Mr. Speaker. 

Mr. Gingrich. I apologize. 

Ms. Waters. The Coalition has hired a PR firm that you work 
for. You work for the PR firm. Is that right? 

Mr. Gingrich. We work with the Coalition. 

Ms. Waters. Do you work for the PR firm that is hired by the 
Coalition? 
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Mr. Gingrich. I would have to check to see whether it is — 

Ms. Waters. Okay. 

Mr. Gingrich. But there is no question we work with the Coali- 
tion. We have said — 

Mr. Green. Would the ranking memher yield, if you would? 

Ms. Waters. Yes, the ranking memher will yield. 

Mr. Green. Mr. Speaker, I have your Wall Street Journal article 
wherein there is an indication at the end that you are a paid ad- 
viser to the Wise Public Affairs group. Are you denying this, Mr. 
Speaker? 

Mr. Gingrich. No, I am not denying — 

Mr. Green. That was the question that the ranking member was 
asking. 

I will yield back to the ranking member. 

Ms. Waters. Thank you very much. 

And the Coalition is funded by what industries? 

Mr. Gingrich. I don’t know. 

Ms. Waters. Does the Coalition represent any other consumer 
groups? Do they advocate for any other consumer groups? Or was 
it just organized to deal with their concerns about the Consumer 
Financial Protection Bureau? 

Mr. Gingrich. My impression is that they think that the threat 
from the CFPB is large enough that that is their primary focus. 

Ms. Waters. I am not interested — 

Mr. Gingrich. And it is the only bureaucracy — 

Ms. Waters. — Mr. Speaker, in your impression. But is that ex- 
actly what they do, just — 

Mr. Gingrich. I don’t know. You would — 

Ms. Waters. — the Consumer Financial Protection Bureau? 

Mr. Gingrich. — have to call them and ask them. They asked me 
to advise on one thing. 

Ms. Waters. I know that you are very smart, Mr. Speaker, and 
you wouldn’t work for somebody that you didn’t know who they are 
and what they do. So that is why I ask you. 

But let me just move on, because I know you understand how 
this place works. You talked about the fact that it is the only agen- 
cy that operates in the way that it does, that it is the only agency 
that does not have to go before the Appropriations Committee. Do 
you really know and understand that to be true? 

Mr. Gingrich. That is certainly my impression, but if you find 
other agencies that have perpetual life by drawing money in man- 
ners that has nothing to do with the Congress, I think Congress 
ought to, frankly, then hold hearings on bringing them within the 
Constitution. 

Ms. Waters. Are you aware that, for example, the FHFA has one 
Director, appointed by the President, who can only be removed by 
the President, and does not go before any Appropriations Com- 
mittee? Are you aware of that? 

Mr. Gingrich. I wasn’t aware of that. But, as I just said, to the 
degree you would like to give us a list that we could suggest to 
Congress that they bring under annual appropriations, I would be 
happy to — 
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Ms. Waters. Mr. Speaker, I know that you know how this place 
runs. You ran it with a strong hand, so I know you understand how 
it works. 

Does the FDIC go before an Appropriations Committee? 

Mr. Gingrich. I believe it is subject to congressional supervision. 

Ms. Waters. That is not what I asked. 

Mr. Gingrich. I believe it answers to congressional inquiries. 

Ms. Waters. That was not my question. 

In terms of what the President is able to do in determining 
whether or not a director continues as director — the OCC, for ex- 
ample, their director can only be fired by the President. Isn’t that 
right? And the same thing with the FHFA. Is that correct? 

Mr. Gingrich. That is correct. 

Ms. Waters. And the Fed, they don’t go before an Appropriations 
Committee. Is that right? 

Mr. Gingrich. That is right. In fact, I have favored auditing the 
Fed for that very reason. 

Ms. Waters. And the President, for example, can only remove 
the head of the SEC. Is that right? 

Mr. Gingrich. Yes. 

Ms. Waters. Okay. So I just want us to be clear when we com- 
pare the Consumer Financial Protection Bureau with other agen- 
cies. 

Some of us are very appreciative that Dodd-Frank created the 
Consumer Financial Protection Bureau, because prior to the melt- 
down that we had, the recession that we entered into, nobody was 
protecting the consumers. We had all of our oversight agencies who 
basically were supposed to be responsible for soundness, et cetera, 
but they did nothing for consumers. 

And so now we have the Consumer Financial Protection Bureau, 
and we have a whole effort to destroy it. The other side of the aisle 
have made this the top priority in everything that they do. And 
just as Mr. Gupta said, while we had this breach with Target and 
others, never have we had a hearing on any of that. 

So I am glad that you are here today, but I want you to share 
your knowledge with us and tell — 

Chairman I)UFFY. The gentlelady’s time has expired. 

Ms. Waters. — us what you know and what you understand 
rather than — 

Chairman Duffy. The gentlelady’s time has expired. 

Ms. Waters. — some of the other stuff that I am hearing. 

I yield back the balance of my time. 

Chairman Duffy. And there is none left. 

Mr. Gingrich. Can I make one brief comment? 

Chairman Duffy. Maybe you can ask — 

Mr. Gingrich. Okay. 

Chairman Duffy. I want to stick with the rules. 

The Chair now recognizes the gentleman from Colorado, Mr. Tip- 
ton, for 5 minutes. Maybe he will entertain the Speaker’s request. 

Mr. Tipton. Thank you. Chairman Duffy. 

Mr. Speaker? 

Mr. Gingrich. I just wanted to comment — the gentlelady just 
pointed out that all of these various bureaucracies that were re- 
sponsible for oversight prior to 2007 failed, and so the answer is. 
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let’s build another bureaucracy to look after the failed bureauc- 
racies, as opposed to looking at why did all these bureaucracies 
fail. I think it is a fascinating difference of opinion. 

And I appreciate your pointing out that we actually should have 
a study, which Cato may already have, of all of the agencies that 
should be under congressional annual appropriation. I thought that 
was a very useful contribution. 

Mr. Tipton. Thank you, Mr. Speaker. 

Mr. Gupta, I would like to start with you, in regards to personal 
information. You made the comment that no personal information 
is collected. Is gender an identifier? 

Mr. Gupta. Is gender an identifier? Gender standing alone, with 
nothing else? 

Mr. Tipton. How about if we included age? Would that be an 
identifier, those two together? How about ethnicity, if we included 
those three elements? Are those things that can be used to identify 
an individual? 

Mr. Gupta. I take your point, and you are right. A constellation 
of data can certainly be used to identify someone without their 
name. And the CFPB is very concerned about that. And that is 
why — 

Mr. Tipton. Interestingly — 

Mr. Gupta. — if you look at the GAO report, you will see that 
they have a data intake team that carefully, carefully scrubs the 
data before it even enters the Bureau and is disseminated to en- 
sure that you don’t have a constellation of data that can be assem- 
bled to actually identify anyone. 

Mr. Tipton. Well, interestingly, Mr. Gupta, under the CFPB, 
with the NMD, they do require the collection of gender, age, and 
ethnicity. 

Mr. Calabria, would you like to maybe comment on that? 

Mr. Calabria. Again, I would agree that only a small number of 
information is needed to identify people. 

I do want to emphasize, as I pointed out in my testimony, and 
as the Federal Reserve Inspector General pointed out, a significant 
amount of the CFPB data collection is maintained by contractors 
on cloud computing, which in my opinion — granted. I’m not a tech 
expert — leaves it particularly vulnerable to hacking. 

So I would certainly encourage the CFPB to bring more of that 
data — here, I am going to say it for a second: Cato Institute, Mark 
Calabria, encourages less use of contractors and more government 
employees, in this case. 

Mr. Tipton. Does the GAO report that the CFPB does not have 
the security protocols in place to be able to secure this data scare 
you? 

Mr. Calabria. That is correct. And that is a very big concern of 
mine, the security of this data. 

Mr. Tipton. If I could follow up again with you. Dr Calabria, for 
a long time, I have held the belief that with a lot of the regulatory 
bodies, the heart may be in the right place, but we need to be able 
to look at outcomes. 

And I get a general sense, going back to Speaker Gingrich’s 
point, that we actually have an institution right now, through the 
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CFPB, that is completely off the hooks. Congress has no real con- 
trol to he able to actually control it, to he able to direct it. 

Do you have a sense that we have a system in place that is con- 
tinuing to build, that is designed to be able to find and punish, 
rather than help and improve? 

Mr. Calabria. So let me first say, there is a fair amount of work 
in the psychology literature about, when people feel like they are 
wrapped up in a cause and self-righteous. And I think that, cer- 
tainly, the CFPB’s attitude is, “We are a crusade. We are here to 
protect the consumer. We are going to fix the financial crisis.” And 
we saw the same thing in the intelligence community after 9/11. 
When you get caught up in this mentality, you get blinders, you 
get tunnel vision. There is a lot of psychology research which I 
think clearly demonstrates that. 

And so what you need — and, again, I would reference one of the 
citations in my testimony from something by Cass Sunstein, of all 
people, who really argued that you need to have procedures and 
checks in place so that dissent is heard. 

And this is one of the — the value of a board is that somebody sits 
there and says — just like this committee can have this dialogue 
and this back-and-forth — is there needs to be this back-and-forth. 
And Wayne talked about, at the end of the day, every employee at 
the CFPB needs to say, “yes, sir” to Mr. Cordray, and I think that 
is a real problem. 

None of us have all the answers, and you lack this institution for 
this dialogue and this back-and-forth and this give-and-take. You 
need that. And other places that don’t have this don’t do well. It 
was mentioned that a number of other agencies — look at OFHEO, 
who was the regulator for Fannie Mae and Freddie Mac, and had 
a single director. We saw how that turned out. 

So, again, the attitude that you can’t have this sort of give-and- 
take, I think is critically important. 

I will also note, the argument you often hear is we need a single 
director so it isn’t captured by the industry. I am not a mathemati- 
cian, but the last I checked, I think it would be easier to capture 
one person than it would to capture, say, five. 

Mr. Tipton. One thing that genuinely concerns me about this is, 
if we were to apply the same rules to the CFPB that they are try- 
ing to apply to everyone else, if we were getting ready to make a 
mortgage — and, again, go back to the comments in terms of identi- 
fiers about gender, age, ethnicity in determining and making a 
loan, they are collecting this data with no consumer knowledge. 
How would the CFPB address a private-sector entity in doing that? 

Mr. Calabria. Let me make two quick points since you are out 
of time. 

First of all, the JPMorgan example, I can choose not to use 
JPMorgan, and if I do, I can sue them if they distribute my data 
in a personal way. And, plus, they suffer. Target took a big hit. You 
don’t see any of this with the Federal Government, in terms of 
these corrections. 

But, lastly, I want to say we don’t have to wonder how this 
works. The HMD A is an example of where there is not personally 
identifiable information but you can link it to courthouse records 
to figure out the identity. It is not that hard. 
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Chairman Duffy. The gentleman’s time has expired. 

The Chair now recognizes the gentleman from Missouri, Mr. 
Cleaver, for 5 minutes. 

Mr. Cleaver. Thank you very much, Mr. Chairman. 

And thank all of you for being here. I appreciate it very much. 

Mr. Speaker, you may have misspoken. You said that the CFPB 
was totally secret. And so I am assuming that you weren’t — and 
this is not a catch-you-wrong question. I am just — when you made 
the comment, I just wrote it down, because I didn’t think you were 
saying that the CFPB was a totally secret agency. 

Mr. Gingrich. My impression is, if you look at various hearings 
and various interrogatories, that the leader of the CFPB has re- 
markably little interest in sharing with Congress a whole range of 
information, including the various cost overruns, including salaries, 
and so forth. So my impression is that they are a remarkably secre- 
tive operation for a non-national-security operation. 

Mr. Cleaver. Okay. I agree with you if you use “remarkably se- 
cretive” as opposed to “totally secretive.” Because if it was totally 
secretive, we wouldn’t have this hearing. 

Mr. Gingrich. I am happy to be amended to “remarkably.” 

Mr. Cleaver. Thank you. 

Mr. Abernathy, do you think that it is important that we have 
evidence-based policies? 

Mr. Abernathy. Absolutely, Congressman. 

In our view, when you have an agency that is led by just one in- 
dividual, without all of the other checks and balances and oversight 
that other agencies are subject to, you are left with just one check, 
and that is the exposure to the public, letting the public see what 
is the information that you used to make your decisions, and let’s 
have a debate on that to make sure you are not operating in an 
arbitrary manner. 

I can think of no agency where that is more important than it 
would be at the Bureau to make sure that they avoid getting into 
arbitrary action. That is why we are so concerned about their data 
practices. 

Mr. Cleaver. Yes. Here is something that I am interested in: 
What county do you live in? 

Mr. Abernathy. I live in Fairfax County, Virginia. 

Mr. Cleaver. I am not familiar with the way that county oper- 
ates, but do you believe that the county has data on your mort- 
gage? 

Mr. Abernathy. I don’t have a mortgage anymore. But I think, 
when I had a mortgage, they probably had some information. 

But what is interesting about Fairfax County is that they have 
a series of seven, I believe, elected officials, and these officials all 
are peers of one another, and they check one another’s activities. 
And that prevents the abuse of data because they will call some- 
body else on it. They will say. Madam Chairman, or whomever, 
there is more information that you need to take into account. 

There is no one like that at the Bureau. There is no peer at the 
Bureau for the Director of the Bureau. Everybody reports to him. 

Mr. Cleaver. Most counties, maybe not in Fairfax, but most of 
the other counties around the country have a lot of data on your 
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mortgage. They have a lot of data on — well, not on your mortgage, 
but on people who hold mortgages, a lot of data. 

The same thing, I think, holds true when you think about some 
of the commercial data that is available. The DMV, does it not 
have a lot of data about individuals who drive and about the ma- 
chine they drive? 

Mr. Abernathy. Yes, they certainly do. Congressman. I think 
what makes the Bureau different is that they can put all these dif- 
ferent pieces together. 

If you look at the authority that has been given them under 
Dodd-Frank, there is virtually nothing that a covered firm, a firm 
subject to its jurisdiction, has in terms of information that the Bu- 
reau cannot demand. And, in their recent data collections, they 
have been gathering in enormous amounts of those data and put- 
ting it all in one place. 

Mr. Cleaver. We have probably had more hearings on the CFPB 
than we have had on anything. So I think it is erroneous to say 
there is nobody looking at the agency. That is all we do. It has be- 
come the political punching bag of this whole Congress. 

And maybe the Speaker was right. Look at the OCC, the FDIC, 
and the Federal Reserve; they are all in the data collection busi- 
ness. 

And so, we can create this attitude that this is going to be a Big 
Brother operation and they are going to give money to the Taliban 
or whatever, and I think we are taking this stuff too far. 

I yield back, Mr. Chairman. 

Chairman Duffy. The gentleman yields back. 

The Chair now recognizes the gentleman from Maine, Mr. 
Poliquin, for 5 minutes. 

Mr. Poliquin. Thank you, Mr. Chairman. I appreciate it very 
much. 

And thank you, gentlemen, for coming here today. I appreciate 
it. 

I come from the private sector, and for 35 years I have been run- 
ning small companies. And when you come from a business back- 
ground, you have to be accountable all the time. You have to be ac- 
countable to your employees, to your customers, and to your sup- 
pliers. You have to be accountable to your board. If you have a 
product or a service that is overpriced or performs poorly, you are 
going to go out of business. Now, it seems to me that we should 
do the same thing here in government, but, unfortunately, it 
doesn’t happen very often. 

When I was State treasurer up in Maine, I was on the board of 
an independent public housing authority. And shortly after joining 
the board, I realized that the executive director had a 5-year term, 
appointed by the Governor, and couldn’t be fired. The board had no 
authority. The executive director didn’t report to the board. And it 
had a funding source that was independent of appropriations. 

Now, after a little bit more digging, we found out that we had 
6,000 families waiting in Maine to come in from the cold so they 
could have a safe and warm place to live, and we had a public 
housing authority that was spending money on theater programs 
for prison inmates. 
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As well as the fact that any request from the board to get data 
on how the operation was performing was just ignored. And then 
we found out that they were spending twice as much to build one- 
bedroom apartments than it cost to buy a single-family home on a 
quarter-acre with a garage, two bathrooms, and three bedrooms. 

So we changed the law. We made sure that the executive director 
reported to the board, we put in financial controls, and we put 
business people on the board. And, by the time I left, the cost per 
unit had dropped to about 35 percent, it was still going down, and 
we helped hundreds more families. 

Now, I am looking, Mr. Gingrich, at the CFPB. And we have an 
independent organization, as you mentioned, that reports to no- 
body. The Director has a 5-year contract, and can only be replaced 
by the President. They have a revenue stream that is divorced of 
appropriations from Congress. 

And all I am asking you is, did it make sense when the Director 
showed up here 6 months ago and tried to convince us that it was 
a darn good idea to spend $216 million on an office building for 
their 1,400 employees, to rehab it, they don’t own it, with a two- 
story waterfall in the building and a reflecting pool and a play- 
ground on the roof? Now, how can we trust these people to collect 
the sort of data they are doing here in America for our families? 

In our district, we had a major breach of data security with the 
largest health insurance provider in the State. Thousands of people 
in my district had their personal data violated. 

So I ask you, Mr. Speaker — ^you have a lot of experience in this 
area — what can we do to fix this? Do you trust this organization 
to collect the sort of data that they are? And if not, how in the dick- 
ens do you fix it? 

Mr. Gingrich. Thank you. And I have to confess, the entire story 
about the Maine housing authority is amazing and would almost 
be a study in its own right. 

Let me say first of all, just to set the record straight, both the 
Department of Justice and the Federal Trade Commission had con- 
sumer protection responsibilities prior to 2008. So this notion that 
magically we are going to create a new super-bureaucracy all on 
top of the other bureaucracies because this new bureaucracy will 
be terrific — and you just described the arrogance of power. 

Since they are totally uncontrolled, and since they are virtuous 
and should not be questioned, why shouldn’t they have a waterfall 
in the atrium? Why shouldn’t they be able to walk in and look up 
and think, I am here to protect America on my terms, based on my 
prejudice, and applying my ideology, and aren’t you lucky to have 
me as the savior of consumer behavior? 

That tells you everything about why this agency ought to be 
abolished, whether you want to break it up and put it back at the 
FTC and the DOJ, or whatever. One other thing the CFPB will not 
tell you is all of their various data-gathering techniques, but we are 
told that there are consumer data companies which sell informa- 
tion to them which includes personal data. 

Now, that should be findable, and that is the kind of thing we 
ought to say, explain to me why you think you are going to keep 
this anonymous, given modern technology and modern information 
systems? 
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Mr. PoLiQUiN. For us here today and those listening, Mr. Speak- 
er, can you give us another couple of tangible examples, to the best 
of your knowledge, of how you connect data protection with ac- 
countability in government agencies like this? 

Mr. Gingrich. As I said earlier, I think anytime you start cen- 
tralizing information into specific banks of data, you have to as- 
sume that you are really at high risk. 

And I would raise the question — again, we always have the gov- 
ernment show up and tell us, “Everything is fine,” until the next 
huge data breach, and then they come back to tell us, “But now, 
everything is really fine.” 

We are in a competition in which there is a free market of hack- 
ers worldwide, all of whom can operate without red tape, without 
limitations, without all of our various rules and regulations, and 
bureaucratic structures that are stunningly slow and incompetent. 
I find no reason to believe this particular structure is going to be 
dramatically better than 0PM at protecting data. 

And I think aggregating the numbers I gave you earlier, billions 
of data points in one place is really defying everything we have 
learned about the emergence of a very aggressive hacking culture. 

Mr. PoLiQUiN. Thank you, Mr. Speaker. I appreciate it very 
much. 

Chairman Duffy. The gentleman’s time has expired. 

The Chair now recognizes the gentleman from Tennessee, Mr. 
Fincher, for 5 minutes. 

Mr. Fincher. Thank you, Mr. Chairman. 

Mr. Gupta, would you support a five-person governing panel in- 
stead of the one director at the agency? 

Mr. Gupta. I would not. I think that, as Ranking Member 
Waters mentioned, there are lots of agencies that have single direc- 
tors — 

Mr. Fincher. Okay. That is it. 

Would you support having CFPB under the appropriations proc- 
ess? 

Mr. Gupta. No, I would not. 

I think the OCC, and lots of other banking regulators, are not 
subject to the appropriations process, but they have an even worse 
source of funding, historically. They have gotten their funding from 
the entities they are regulating. 

Instead, what you have here is a stream of money that comes 
from the Federal Reserve Board, and it prevents agency capture. 
It prevents the agency from being subject to the thing that makes 
Washington broken in every respect, which is the influence of fi- 
nancial industry money. 

Mr. Fincher. Okay. And — 

Mr. Gupta. That is why you are having so many hearings, I as- 
sume, on — 

Mr. Fincher. What makes Washington broken is too much 
Washington and too many bureaucrats. 

I think the narrative here that we are hearing from my col- 
leagues on the other side of the aisle — and no offense to Ranking 
Member Waters, she is very passionate about this; she just hap- 
pens to be wrong — is that the American people aren’t smart enough 
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to make decisions on their own, so bureaucrats and politicians in 
Washington are going to tell them what to do. 

Another one of my colleagues trying to compare data collection 
at the CFPB to my county in my rural district in Tennessee is a 
joke. We look back at a lot of the reasoning behind Dodd-Frank and 
behind the CFPB, because the private sector was out of control, 
when in a lot of respects it was Fannie and Freddie that were in- 
fluencing the private sector and telling banks who to loan money 
to. 

So, let’s get to the facts. The facts are, for a lot of my friends on 
the left, they see the private sector as a problem, and everything 
should be done in Washington and by bureaucrats and politicians. 
This is a slap in the face to the American people. They are smart 
enough to figure out what works and what doesn’t, and they don’t 
need people in Washington doing it for them. 

Mr. Abernathy, if the CFPB were to use this data irresponsibly, 
are you concerned with a lack of accountability? And how would we 
rein them in? They are almost untouchable. 

Mr. Abernathy. That is a serious problem, and that is one of the 
things that we believe this hearing is bringing out, is the fact that 
all you have to act as accountability for the Bureau is the public 
exposure of the data that they claim that they rely upon. And yet, 
when we look at the decisions that they have made, rather than 
relying upon the data to drive what they do, they cherry -pick the 
data through processes that they don’t reveal to the public, in order 
to silence debate rather than to foment debate by basically saying, 
this is what the data tells us we have to do; therefore, there should 
be no discussion. 

In one case, they have actually demonstrated the value, and that 
is with regard to their arbitration study, where they did put the 
data out for people to look at, and the data actually disprove the 
assumptions they make in their study, but it encourages a broad 
discussion by the public. And that is what we need. 

Mr. Fincher. Dr. Calabria? 

Mr. Calabria. I want to make a couple of points, but first, I 
want to go back to the funding issue. 

Let’s remind ourselves that the CFPB is funded in the same way 
that the Federal Reserve itself is funded. And I think it is widely 
accepted that the Federal Reserve fell down on the job before the 
crisis despite being outside of the funding process. 

And of course, as we know, Mr. Greenspan, Mr. Bernanke, and 
Mrs. Yellen are not accepting campaign contributions from Wall 
Street. That is not why they screwed up. They screwed up for a 
number of reasons. Of course, you could try to say, well, they 
screwed up because Mr. Greenspan has some crazy ideology and 
whatever. That is actually an illustration of why you don’t want 
one single powerful person, because how will you know that person 
is not going to get the check and balance? 

And, in fact, the only way we know that there were discussions 
about subprime lending at the Federal Reserve is because Ned 
Gramlich, one of the Board Members, forced that conversation. And 
that was a conversation that was at least had, which would not 
have been had if it was a single director. 
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So, again, let me clearly state for the record so that we don’t 
have to go back over this topic, the CFPB is not the only part of 
the Federal Government or our financial regulatory structure that 
is broken. I think we can accept that. I don’t subscribe to the two- 
wrongs-makes-a-right theory of policy. So just because something is 
broken over at agency “A” does not, in my opinion, justify us to 
leave something broken at agency “B.” 

Mr. Fincher. My time is expiring. Let me just say this in clos- 
ing. 

Hopefully, a Republican Administration will take over in 2017, 
and my friends across the aisle will be singing a very different tune 
at that time, but let’s remember that, to your point, two wrongs 
don’t make a right. We need to call this out for what it is. And if 
Republicans were doing it, it would be wrong also. But let’s fix this. 

And, please, my friends on that side of the aisle, give the Amer- 
ican people some credit. They are smarter than Washington. 

I yield back. 

Chairman Duffy. The gentleman’s time has expired. 

The Chair now recognizes the gentleman from Arkansas, Mr. 
Hill, for 5 minutes. 

Mr. Hill. Thank you, Mr. Chairman. And thanks for calling this 
hearing. 

It is certainly good for me to see my old friend, Wayne Aber- 
nathy. We served so long ago on the Senate Banking Committee 
staff, Mr. Speaker, that there was no TV in the Senate. That is 
how long ago it was. Many moons have passed. 

I feel like Rip Van Winkle when I come back to Washington after 
25 years and see this kind of behavior. And this isn’t the first time 
we have talked about a subject like this at a hearing. FINRA pro- 
posed a proposal called CARDS, where they would sweep up every 
brokerage account in the country and every brokerage transaction 
and organize it in a way that it would not be identifiable so that 
they could just look at it. 

And my whole problem with things like this is just because you 
can, doesn’t mean you should, in these massive data collections, 
when a simple sample would do just as well in trying to look for 
a trend analysis. 

And, further, our whole regulatory system has been based on 
looking at institutions and looking at the activities of that institu- 
tion on a small-scale basis and making determinations about, did 
the executives of that institution do a good or a bad job with regard 
to consumer legislation or prudential regulation. That has not been 
the sweeping 170 million loan records, for example, that are now 
in the hands of the CFPB. 

In my district in Arkansas, this spring has been taken up by 
working 70 cases of IRS identity theft. And it is all we talk about 
in my office: identity theft problems with federally-stored data. So 
I have concerns about that. 

Mr. Gupta being here, it reinforces, I think, why I ran for Con- 
gress, and why I was glad the people of Arkansas elected me to 
Congress. Because once again, I feel like you are the chief apologist 
for an intrusive. Big Brother, Big Government solution. 

We have had hearings, sir, in this room on the Target breach. 
We had retailers and bankers testify about those breaches. And we 
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have bills moving in the Energy and Commerce Committee in this 
House and in this committee, Financial Services, to deal with that. 
So don’t make the assumption that we have not had data breach 
discussions in — 

Mr. Gupta. And I commend you for those efforts. Those are good 
efforts. 

Mr. Hill. Thank you. 

And, also, you stated that this committee is making up facts, 
when, in fact, I think The Wall Street Journal was quite clear, and 
I commend the staff of this committee. In the made-up-fact arena, 
it is the CFPB and their auto finance investigation that has gotten 
the world record for made-up facts in their most recent efforts. 

So I would like to get some thoughts, Mr. Speaker, on this issue 
of why the CFPB claims it needs all this information in order to 
understand the markets it regulates. In my opening comments, I 
talked about how individual firms and individual prudential man- 
agers deal with markets, and that is how we have traditionally reg- 
ulated it. And they have collected 87 percent of the credit card 
market. They have collected 95 percent — it is trying to get 95 per- 
cent of all the credit card accounts. 

What do you think is any justification for that, when one could 
just do a survey of credit card vendors for a small sample to meet 
any analysis, it seems to me, that would have a public policy ben- 
efit? Could you comment on that for me, please? 

Mr. Gingrich. Thank you. 

Look, Friedrich Hayek, in “The Road to Serfdom,” made the ar- 
gument that, once you start toward centralized planning, you inevi- 
tably coerce, and that the centralized planners think of themselves 
as virtuous and as having a fact-based approach to life, when, in 
fact, they are like the rest of us. They have ideologies, they have 
things they like, they have things they don’t like. 

It is very funny, in a sense. This is a monster which, if Demo- 
crats thought about it, they would rush to create a bipartisan 
board. Imagine you have a President Cruz or a President Trump 
and they decided to appoint their version of this kind of collection 
agency, and that person was now in total charge of gathering the 
data they wanted to gather so that, let’s say, instead of being 
antigun, as the current group is, they decided they were pro-gun, 
and so they decided that you really ought to have lots of credit if 
you are a gun dealership and so forth. 

You need to understand, when you put total power in one per- 
son’s hands and they can operate in — not total secrecy but sur- 
prising — 

Mr. Hill. Remarkable secrecy. Yes. 

Mr. Gingrich. — remarkable secrecy, you are creating a natural 
pattern that leads to very dangerous behavior, for this reason: The 
government always, in the end, is about power and the ability of 
the state to coerce. And when you have people in darkness who are 
able to exercise the power of the state, they apply their prejudice 
and their ideology. And that can destroy normal people because the 
government is so big and so powerful. 

Mr. Hill. Thank you, Mr. Speaker. 



26 


I have Fourth Amendment concerns about this process, as I did 
on CARDS. It is not the direction we should be going in regulation 
in this country. 

And I yield back. 

Chairman Duffy. The gentleman’s time has expired. 

The Chair now recognizes the gentlelady from Ohio, Mrs. Beatty, 
for 5 minutes. 

Mrs. Beatty. Thank you, Mr. Chairman, and Ranking Member 
Green. 

Let me first say thank you to the panelists for being here and 
that I am also proud to associate myself with the comments from 
my ranking member of the Financial Services Committee, Con- 
gresswoman Maxine Waters. 

Mr. Chairman and to the witnesses today, certainly this is an 
important topic. When I received my overview with the name of the 
topic today that we were going to look at, consumer protection and 
data security, it kind of puzzles me, as we have witnesses here, 
that we don’t have anyone here who is actually from the agency 
that we are talking about, and that we have certainly discussed — 
which probably are important, for us to hear our different views 
from our witnesses — that go far beyond what I think we should be 
discussing at hand. We are talking about the establishment and 
how it was established 5 years ago. We are talking about the budg- 
et. We are talking about everything but the real issue of what this 
hearing was scheduled to do, which I think is unfortunate and a 
disservice to me and to our constituents. 

I would also be curious as to your expertise, starting with you, 
former Mr. Speaker. Can you tell us your expertise as a cybersecu- 
rity expert? I know that you are here as yourself, as you com- 
mented. I also know that you are a paid public affairs consultant 
with the Wise Group. 

So tell me what your expertise is in this area. 

Mr. Gingrich. I wouldn’t classify it as expertise, but I have 
worked on data issues and on cyber issues for over 25 years. As 
Speaker of the House, I had a substantial amount of involvement. 
I have this year spent time out at the National Security Agency 
looking at their things. I served for 6 years on the Defense Policy 
Board, and cyber was part of that. 

And I can tell you, as a historian, all you have to do is clip out 
of the newspapers the increasing frequency of cyber activities, the 
increasing frequency of hacking, and the stunning inability of the 
American Government to protect itself, and I think that doesn’t re- 
quire any massive level of expertise. 

I do think it would be wise for the subcommittee to arrange for 
a number of people who have cyber capabilities to come in and ex- 
plain why this is a dangerous thing. And it is dangerous at two lev- 
els. Remember, it is about a mass data collection program. So it is 
dangerous at two levels. We are talking about breaches and hack- 
ing. It is also dangerous because the truth is, in the age of 
metadata, you can identify individuals from supposedly anonymous 
information. And you may want to have a hearing and bring in 
people from places like Carnegie Mellon and MIT and go through 
this. 
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But I will assure you I have spent time with the Army Cyber 
Command, I have spent time at NSA. I am not personally a cyber 
expert, but I think — 

Mrs. Beatty. Okay. Thank you. 

Mr. Gingrich. — I am reasonably knowledgeable. 

Mrs. Beatty. I am going to move on because of my time. 

So based on that, and your clipping out articles and reading 
them, and your past experience, let me ask you this: Some have 
commented that the CFPB is particularly vulnerable to hackers be- 
cause of their heavy reliance on cloud-based computing. Can you 
tell me how you feel about that and why? And what better prac- 
tices, from your reading and the experience you have said, would 
be better? Give me something specific. 

Mr. Gingrich. I think if you talk to people at the Pentagon and 
at the — 

Mrs. Beatty. No, I mean in your opinion, not whom I should talk 
to about it. You are here today. 

Mr. Gingrich. No, I understand. 

Mrs. Beatty. I want to hear from you, not — 

Mr. Gingrich. Okay. 

Mrs. Beatty. — who I can call or who the Republicans can bring 
in. You have shared that you have this experience, and you have 
probably been the most critical. And so I want to be able to discern 
and be able to separate, is this predisposed from articles I have 
clipped out on you and what you have said that is clearly coming 
with some predetermined ideas against the organization and Mr. 
Cordray. 

So let’s keep this in the context and give me some specifics that 
you have. You are sitting here today, not the folks that may call 
or may come here in the future, so let’s hear from you. 

Mr. Gingrich. Okay. And I would say, then, three things. 

One, I believe if you aggregate this kind of data, you always have 
the potential to identify individuals. And I would be glad to provide 
you technical experts who will explain that. 

Two — 

Mrs. Beatty. So, in other words, you don’t have any that you can 
give me. I can call those folks or wait for my colleagues to bring 
in a real expert who is sitting here taking my time up to hear it. 
Thank you very much. 

Let me go to the second gentleman. 

Can you answer that question, please? 

Mr. Abernathy. Thank you. Congresswoman. 

Our testimony is focusing on the policymaking process, and the 
problem that you have when you have a single director with no- 
body who can engage that — 

Mrs. Beatty. No, that is not my question, about the single Direc- 
tor. 

I’m sorry. My time is — 

Mr. Abernathy. That is what our focus is — 

Mrs. Beatty. — up. I yield back. 

Mr. Abernathy. — and our testimony is about. 

Mrs. Beatty. Okay. But that wasn’t my question to you. So let’s 
be clear on that. 

Mr. Abernathy. Right. 
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Chairman Duffy. The gentlelady yields back. 

The Chair now recognizes the gentleman from Illinois, Mr. 
Hultgren, for 5 minutes. 

Mr. Hultgren. Thank you all for being here. 

Speaker Gingrich, it’s good to see you. One of my favorite memo- 
ries of serving over the last 5 years was being with you and your 
wife in Tampico and Dixon, Illinois, for Ronald Reagan’s 100th 
birthday. So I appreciate you being here. Certainly, he is a hero of 
mine, and I appreciate the work you have done talking about him 
as well. 

But I want to get to what I see as a very important subject here. 
I am troubled by all the stories that we have heard of what hap- 
pens to consumer financial information when it gets into the wrong 
hands and how aggressive people are in trying to get this informa- 
tion. Our government should be held to the highest standard when 
it comes to protecting personal information it holds on the Amer- 
ican people. 

On October 15th, the CFPB released its final rule to expand data 
collection under Regulation C, the Home Mortgage Disclosure Act, 
or HMDA. The final rule requires covered banks and credit unions 
to collect 48 unique data fields on each mortgage loan they make. 
This is more than double the number of data fields covered lenders 
are currently required to collect. 

Some of the new fields include applicant or borrower age, credit 
score, automated underwriting system information, unique loan 
identifier, property value, application channel, points and fees, bor- 
rower-paid origination charges, discount points, lender credits, loan 
term, prepayment penalty, nonamortizing loan features, interest 
rate, and loan originator identifier. 

I think we can all agree that this is a lot of information. And 
while some of this information is not directly related to the bor- 
rower or terms of the loan, this data can still be revealing. I under- 
stand regulators and the public make use of this data, but I am 
also concerned that it could pose privacy risks for homeowners. 

Speaker Gingrich, if I can direct this first question to you, I 
think we all remember the Office of Personnel Management data 
breach, and I think we have heard some testimony today about 
how the CFPB’s data security controls may be inadequate. 

In light of the incidents like 0PM and others within the govern- 
ment, how can we assure the American people that their personal 
information is safe? 

Mr. Gingrich. First of all, you can’t. 

Second, you reminded me that I got one of those letters, among 
21 million people, which said my data had been breached, and it 
said, gee, if you want to do something, call this number. I couldn’t 
imagine anything useful. What were they going to do? Say, we 
don’t know exactly who breached it, we don’t know exactly where 
it is, and we don’t know exactly how it will be used? It is just non- 
sense. 

Mr. Hultgren. Yes. 

Mr. Gingrich. The fact that you can live through this, you can 
watch this scale of failure, and then have some other bureaucrat 
sublimely tell you, “Oh, we are safe,” they don’t — my first point is 
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they don’t know. If you are not offline, you are, by definition, poten- 
tially hackable. 

And this is a major crisis for the whole government. This is not 
something that — I have worked with John McCain, the chairman 
of the Armed Services Committee in the Senate, who is very wor- 
ried that we are not able to innovate rapidly enough inside our bu- 
reaucracies to keep up with the private-sector revolution world- 
wide. And it is always worldwide. It is Estonians, it is Romanians, 
it is Russians, it is Israelis. And so, we need to understand the 
threat. 

I think that is a significant thing, and I would encourage the 
committee to get people from places like Carnegie Mellon and MIT. 
Let’s meet everybody’s concern about the level of technical exper- 
tise. And I think you will find that they will tell you, “You should 
be afraid. You should not be reassured.” 

Mr. Hultgren. I believe you are right. I just had a briefing this 
morning with the Department of Energy on cybersecurity — and 
some real concerns, real threats, real experts who are frightened — 
having nightmares, they talked about what could happen. And we 
see this as just as widespread. 

I am going to ask a question, just a yes-or-no question. Speaker 
Gingrich, Dr. Calabria, and Mr. Abernathy, the CFPB’s final rule 
did not explicitly state which of this new data would be made pub- 
licly available. It seems to me a study on the privacy risks and the 
opportunity for public comment would be appropriate, just as 
Speaker Gingrich was talking about. 

Mr. Speaker, I think you have already answered. Would you 
agree that this is a good position? I think you would say “yes.” 

Mr. Gingrich. Yes. 

Mr. Hultgren. Mr. Abernathy? 

Mr. Abernathy. I agree. Congressman. Thank you. 

Mr. Hultgren. Dr. Calabria? 

Mr. Calabria. Yes. 

Mr. Hultgren. Let me jump back and focus on Dr. Calabria and 
Mr. Abernathy. Do you have any thoughts on why the CFPB chose 
to go well beyond the new reporting requirements in Section 1094 
of Dodd-Frank? The CFPB loves to say they are data-driven in 
their policy, but doesn’t the increased reporting of this data raise 
more privacy issues? 

Mr. Abernathy. That is one of the serious concerns when you 
look at the more than two dozen additional data segments that the 
Bureau asked for. And yet, there really is inadequate discussion as 
to why they need this data, and what they would do with it. We 
need that kind of public debate before they do the rule rather than 
afterwards. 

Mr. Hultgren. I agree. 

Dr. Calabria? 

Mr. Calabria. And I would certainly agree with that. 

Let me say, even before this, from what was publicly available 
for HMDA, you could link to courthouse records and identify indi- 
viduals with that data even with the preexisting databases. 

Mr. Hultgren. Yes. 

I only have a couple of seconds left. 
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This feels like such an overreach at such a risky time. I think 
it is absolutely the wrong direction to go, for CFPB to be doing this, 
and we need to do more to make sure it doesn’t happen. 

Mr. Chairman, I yield back. 

Chairman Duffy. The gentleman yields back. 

The Chair now recognizes the gentlelady from Utah, Mrs. Love, 
for 5 minutes. 

Mrs. Love. Thank you, Mr. Chairman. 

I have to tell you, you have an idea of how dangerously powerful 
some of these regulatory agencies are before you get here, but I 
can’t tell you how shocked I am, getting here and realizing the cas- 
ualness, where we talk about collecting people’s private informa- 
tion, the casualness in saying, “It’s okay. Don’t worry about it. 
We’re here to protect you. We know everything. We’re bigger minds 
than you are, and we can handle things for you.” It is absolutely 
shocking to me, the amount of power these regulatory agencies 
have over the American people. 

I have a couple of questions. As I have gotten into learning a lit- 
tle bit more about the CFPB, I have several concerns, but I want 
to focus, first of all, on some of the data collecting, which raises pri- 
vacy concerns, and, second of all, what is being done with that 
data. 

These are the questions — ^by the way, that is not just coming 
from me. They are coming from my constituency. So I do this work 
on behalf of them. 

We have learned that the way that the CFPB uses data and in- 
terprets the data was highly suspect and that the result, the sup- 
posed redress that the CFPB imposed on the marketplace, was not 
correlated with actual harm. There was a lot of guesswork in- 
volved, and the guesswork resulted in the CFPB imposing more re- 
quirements on the auto lending market, which results in higher 
costs and less choices for the consumer. 

So, now, in addition to the auto sales, the CFPB has also been 
collecting data, as we have heard today, regarding credit reports, 
credit cards, mortgages, student loans, payday loans, overdraft 
fees, and other financial data. Over the past year that I have been 
here on this committee, I have been investigating some of that ac- 
tivity, specifically in regards to payday loans and overdraft fees. 

So my question for the panelists is: What other CFPB actions do 
you see on the horizon? What other disappearing options, as you 
would say, for services that consumers, when they are looking at 
it, need to worry about losing? 

Mr. Abernathy. If I may. Congresswoman — 

Mrs. Love. Yes. 

Mr. Abernathy. — one of the areas we are particularly concerned 
about is the ability to serve the market for short-term and small- 
amount loans. Our estimate is that there are 54 million customers 
each year in the market for small loans, short-term loans — these 
are loans for less than a year — and the Bureau is on the verge of 
decreasing significantly the access to those kinds of resources. 

They have the payday lending rule that they are about to come 
out with that, estimates are, will eliminate 80 percent of that mar- 
ket in one decision. We are concerned that they are looking at over- 
draft, where a number of people who have bank accounts use the 
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opportunity to overdraw their account a little bit to be able to ob- 
tain immediate short-term credit for a variety of needs, from a va- 
cation to a major emergency that takes place at their home. 

And yet, we have looked at the way they exposed data on this. 
One data segment that they put forward indicated that, in their 
view, the median average overdraft is $24, for which people paid 
$34. If they actually look at what happens with all of the data for 
an institution, they would discover that the amount of credit that 
customers receive versus what they paid for it for overdraft is 
something like 7 to 8 times the amount of the fee. 

But by manipulating the data in ways that no one can really get 
at and challenge, they end up promoting policies that could choke 
off the opportunity for overdraft to be a source of credit for millions 
of people. 

Mrs. Love. So far, what I have seen is the people that they have 
vowed to protect are the ones who are being hurt the most. 

And I just want to say — ^because I am not here to necessarily 
change the minds of my colleagues, because a lot of the minds have 
been made up, on both sides of the aisle. I am here to make sure 
that we are transparent and we give a fair warning, a warning to 
the American people, that if we continue to allow this to happen, 
the only people who are at risk are them, are the American people. 

Let me just say right now, this is a fair warning that if we are 
not vigilant, if we do not cry out and make our voices heard that 
this is, first of all, unacceptable, and second of all, we are smart 
enough to make decisions in our homes and for ourselves — and if 
we do not do something now, then the only people who are at risk, 
who have the risk of losing everything, are the American people. 

I yield back. 

Chairman Duffy. The gentlelady yields back. 

The Chair now recognizes the gentleman from Minnesota, Mr. 
Ellison, for 5 minutes. Welcome. 

Mr. Ellison. Let me thank the Chair and the ranking member 
and thank the panel. I really appreciate having time to discuss this 
issue today. 

Mr. Gupta, I would like to ask you a question, if I may. You 
made the comment, unless your profits come from deceiving con- 
sumers, you should welcome the CFPB’s data collection. Could you 
explain what you meant by that? 

Mr. Gupta. Sure. Thanks for the question. 

The reason we have the CFPB in the first place is because we 
had a massive regulatory failure, right? We had a financial crisis 
that resulted from all sorts of fringe lending that was entirely un- 
checked. People were asleep at the switch. You didn’t have anyone 
who was looking out for consumer protection. The Federal Reserve 
Board was looking out for other things, and consumer protection 
took a backseat. 

And so we created a single agency that is the voice of the Amer- 
ican consumer. It is actually standing up for American consumers 
and trying to prevent the kind of practices — those practices didn’t 
just harm people who had subprime mortgages, right? They threat- 
ened to harm all of us. They threatened to tank the American econ- 
omy and the world economy. 
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So, unless your business model is based on unfair and deceptive 
practices, the kind of thing that the CFPB pursues in its enforce- 
ment actions and its regulations, you should have no concern about 
transparency and about the CFPB having that data and using it 
as a tool to do better consumer protection. 

Mr. Ellison. Thank you. 

So, honestly, I have to admit something. When I first saw the 
panel lineup, I thought to myself that my friend, Mr. Gingrich, has 
a Ph.D. in history and he may know a lot about that, but what 
does Newt Gingrich know about big data? I was just a little sur- 
prised by that choice. 

But it turns out that you actually do know a lot about big data, 
because — let me put it like this. Republicans, in general, claim that 
they have collected more than 300 terabytes of voter data, includ- 
ing more than 725 billion data points on nearly 200 million Amer- 
ican voters. This information is matched to individuals in voter 
data files, which also contains personally identifiable information — 
home address, phone number, email. 

Not only are Republicans collecting massive amounts of voter 
data, some Republicans even rent out the data to other campaigns. 
Well, they rent that data to a list of brokers that lease data to mar- 
keting firms and other private entities. For example, the Presi- 
dential campaign for Newt Gingrich, Newt 2012, reported getting 
$17,000 in the most recent FEC reporting cycle, even though that 
campaign dropped out of the primary more than 3 months before. 

A separate company, Gingrich Productions, also uses a list 
broker to sell personal information via TMA Direct. For the low 
price of $120 a month, you can get access to nearly 500,000 individ- 
uals’ personal information who were never before on the market. 

So I did have my doubts about whether our panel was qualified 
to offer opinions on such a complex topic, but, clearly, clearly. 
Speaker Gingrich, you do know something about making money off 
big data. 

So I guess my question is, if it is okay for you to sell big data 
with personal information, why can’t the CFPB rely on anonymous 
data to protect consumers? 

Mr. Gingrich. Look, that is a great question. As often with you, 
it was a brilliant setup. 

It is true that we have carefully studied the 2008 and 2012 
Obama campaigns. And it is true that, while we are still behind 
them in gathering metadata and while we don’t have quite the ties 
they have in Silicon Valley and at major intellectual centers, we 
are doing everything we can on the Republican side to be at least 
as good as the Obama team at using metadata. So I appreciate 
your recognizing that, while we are second, we are working hard 
to catch up. 

Second, the big difference — and you put your finger on it: I can’t 
go to somebody and threaten to cut off their bank loans. I can’t go 
to somebody and threaten to put them in jail. People who happen 
to be on my list voluntarily signed up to get information from Newt 
Gingrich and can voluntarily get off the list without having a bu- 
reaucrat call and threaten them. 

If you look at the power of the government — which is always, in 
the end, coercion — and you imagine random independent bureau- 
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crats who aggregate to themselves the right to decide what my con- 
sumer choices should he, that is real power. We don’t have real 
power. We are just a private company doing private things in a free 
market. And that is why I am so frightened to see this much power 
in the government. 

Mr. Ellison. And making a good penny at it in personal data. 

Thank you, Mr. Gingrich. 

Chairman Duffy. The gentleman yields back. 

The Chair now recognizes the ranking member of the sub- 
committee, Mr. Green from Texas, for 5 minutes. 

Mr. Green. Thank you, Mr. Chairman. 

Let me start with a few questions, and I would like for you to 
raise your hands if these questions apply to you. 

If you are in any way, now or ever, connected to the U.S. Con- 
sumer Coalition, would you kindly raise your hand? 

Let the record reflect that Mr. Gingrich has raised his hand. 

If you are now or you have ever been paid by the Wise Group, 
if you would raise your hand — the Wise Public Affairs group. 

Thank you. 

And, Mr. Gingrich, since you have raised your hand both times, 
I would like to know a little bit more about the Wise Public Affairs 
Group. But before I get there, I want to go back to something that 
you and I have broached earlier, and it has to do with your state- 
ment. 

Because, in your statement, you do indicate that you are an advi- 
sor, in an advisory capacity. But I was hoping that you would do 
what was done when The Wall Street Journal had to issue its addi- 
tional statement, and that is indicate that you were a paid advisor 
to the Wise Public Affairs Group. Because you well know that the 
Wise Public Affairs Group owns and operates the U.S. Consumer 
Coalition. 

So I was disappointed that this was not called to our attention. 
As has been indicated, this is not the first time this has been done. 
You pride yourself in transparency, but, for some reason, you didn’t 
reveal this money connection. You were willing to reveal that you 
just happen to advise, but you are making a profit based upon this 
advice because you work for the Wise Group. 

If I have misstated this about your working for the Wise Public 
Affairs group and also being connected to the U.S. Consumer Coali- 
tion, would you kindly raise your hand again? Because I would like 
to hear from you if you have. 

Let the record reflect that what I have said, per Mr. Gingrich, 
is accurate. 

And this is why we bring this up, Mr. Gingrich: Because this 
U.S. Consumer Coalition is out to emasculate the CFPB. It has 
published its intent in terms of what it would like to do to the 
CFPB. 

There are many of us who are of the opinion that the CFPB 
serves a meaningful purpose. And we are of the opinion that in 
serving this meaningful purpose, the CFPB has done a good thing. 
The CFPB makes it possible for consumers to receive restitution 
after they have been harmed. And it is unfortunate, but I think it 
is fair to say that if the rule that you would have us adhere to were 
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implemented, then there are many consumers who would not re- 
ceive the benefits that they have received already. 

The personally identifiable information of which we speak is not 
by law permitted to be used for market monitoring — not by law. It 
can’t be used. But it can be used for enforcement activities, which 
means if you find out that a consumer has been harmed, you can 
take that personally identifiable information and you can then con- 
tact that consumer and say, “You have been harmed,” as was done 
with the $4.5 billion in relief that was given in debt collection, $50 
million of it in civil penalties, I might add; $2 billion to consumers 
related to credit card enforcement, $140 million for civil penalties; 
$125 million to consumers for auto finance enforcement, defrauded, 
taken advantage of, $25 million of it in related civil penalties; $115 
million in relief for mortgage lending enforcement, $55 million of 
that in civil penalties; $20 million in relief to consumers for stu- 
dent lending enforcement, $2 million related to civil monetary pen- 
alties; $19 million to consumers for payday enforcement activities, 
over $10 million in related civil monetary penalties. 

So if we decide that we are no longer going to allow the CFPB 
to aggregate information for enforcement purposes, we now take 
away these dollars that are going to consumers, because we won’t 
be able to find out who they are and contact them. I suppose there 
is some nebulous way that someone would conclude that we could 
do this, but the truth of the matter is that enforcement activities 
benefit seniors. 

The CFPB is in the business of helping people, and this would 
eviscerate it to the extent that it would be emasculated, if not evis- 
cerated, such that it could not continue its enforcement activities 
and return moneys to seniors who have been harmed. “Senior citi- 
zens” is a more appropriate term — consumers. 

I yield back. 

Chairman Duffy. The gentleman yields back. 

The Chair now recognizes himself for 5 minutes. 

Now, taking a page from the ranking member, would the panel — 
would you raise your hand if you are surprised that former Speak- 
er Newt Gingrich is fighting for limited government and more 
transparency in government? If you are surprised by that, raise 
your hand. 

Mr. Gupta, you are not surprised by that. It is consistent with 
everything this man has done. 

Mr. Gupta. No. I am surprised that he is paid by the financial 
industry — 

Chairman Duffy. No, no, that wasn’t my question. You are not 
surprised that he is fighting for limited government and more 
transparency. 

What I find unique is that my friends across the aisle want to 
do everything to attack the former Speaker, when this is consistent 
with his life’s work. 

We are talking about big data and abuse of power. And I com- 
mend the Speaker for coming in and lending his voice to this very 
important issue. 

Now, a question to the panel: Do you all agree that American 
consumers are at risk of having their data taken from the collection 
at the CFPB? 
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Mr. Abernathy. Yes, sir. 

Chairman Duffy. Mr. Calabria? 

Mr. Calabria. Yes. 

Chairman Duffy. Mr. Gingrich? 

Mr. Gingrich. Yes. 

Chairman Duffy. Mr. Gupta, do you agree with that? 

Mr. Gupta. I would say of course there is a risk, but no more 
than with any other agency — 

Chairman Duffy. Of course, there is — 

Mr. Gupta. — and less so than with the private sector. 

Chairman Duffy. So, Mr. Gupta, is there another agency out 
there that goes by the “Consumer Financial Protection Bureau?” 
Anyone? Yes or no? 

Mr. Gupta. No. 

Chairman Duffy. So the one that is here to protect consumers 
is also an agency that is putting consumers at risk with the data 
that they collect, right? Yes or no? 

Mr. Gupta. No. It is a — 

Chairman Duffy. You just told me that they were — 

Mr. Gupta. It is a false construct, because — 

Chairman Duffy. No, it is not a false — listen — 

Mr. Gupta. — the risk in the private sector for this data is far 
greater — 

Chairman Duffy. That is not — 

Mr. Gupta. — than it is with the CFPB. 

Chairman Duffy. No. I — 

Mr. Gupta. And what the CFPB — 

Chairman Duffy. I am going to reclaim my time. 

Mr. Gupta. — is doing is no different than — 

Chairman Duffy. As the Speaker pointed out, there is a big dif- 
ference between the private sector and Big Government. If I choose 
to go get a license at the DMV, it is government, they have my in- 
formation, I know that. If I shop at Target or Home Depot, they 
have my information, and I know it. 

Does the American consumer actually know that the Consumer 
Financial Protection Bureau is collecting their information? Do you 
think they know that? 

Dr. Calabria? 

Mr. Calabria. I don’t believe they do. 

Chairman Duffy. Okay. 

Mr. Abernathy, by chance, does the Consumer Financial Protec- 
tion Bureau ask the people whom they claim to protect if they can 
collect their personal information? 

Mr. Abernathy. No. They go to the institutions with which peo- 
ple have voluntarily entered into a business relationship and then 
gather up all of that data and bring it into the Bureau. 

Chairman Duffy. So they don’t ask them, do they? 

Mr. Abernathy. They don’t. 

Chairman Duffy. The very people they claim to protect, they 
don’t ask for permission to collect the data. And they put those 
very people they claim to protect at risk by housing the data. 

Dr. Calabria? 

Mr. Calabria. If I could — I guess I should be careful, as a non- 
lawyer, but I would remind the committee that the Fourth Amend- 
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ment does not apply to the private sector. You can choose. What 
the Fourth Amendment does is constrain the government. And that 
is what we should not lose sight of here. 

Chairman Duffy. I think that is a very good point. 

Another concern that I have, I think, Mr. Gupta, you made the 
point that this agency is better. It is better because it is not subject 
to, I think you said, lobbying and outside forces. They can do the 
goodwill of the people without being subject to the people. Is that 
basically your point? 

Mr. Gupta. No. I mean that all agencies should be held account- 
able, and the CFPB is accountable. We have had countless hear- 
ings about that. 

Chairman Duffy. No, no — 

Mr. Gupta. We talk about it — 

Chairman Duffy. I Chair the Oversight Subcommittee. We have 
asked for countless documents specifically on this. And if they don’t 
turn them over to us, do you think that they are accountable? 

Mr. Gupta. I do. They are — 

Chairman Duffy. So if they don’t give me all of the documents — 

Mr. Gupta. If there is another agency that has had to come up 
to the Hill and testify more than the CFPB over the past couple 
of years, I am not aware of it. 

Chairman Duffy. So, on that point, maybe, Mr. Gingrich, would 
the model be better, then, if the EPA, the DOJ, the Department of 
Health and Human Services, the Department of Education all 
weren’t subject to appropriations, if they would just come and give 
us a few lip-service hearings a couple of times a year? Would de- 
mocracy be better off if we followed Mr. Gupta’s set of ideas? 

Mr. Gingrich. Look, I understand why people who want to co- 
erce and control the American people want to ensure that the Con- 
gress can’t represent people in an effective way. If you think about 
the logic of that, it is perfect. 

But I want to go back to something that your ranking member 
said that I am confused by. If, in fact, the CEPB doesn’t know 
about individuals, how did all that money get back out to individ- 
uals? And how do we know it got to the right individuals? And isn’t 
it the case that, in fact — I am told that in the auto loan problem, 
they actually ended up paying white Americans for racial discrimi- 
nation because, in fact, their algorithms were wrong. So you can’t 
have it both ways. 

And the idea of trying to stop 2007 and 2008 makes some limited 
sense — although the problems weren’t bureaucratic; they were 
judgment. But the idea that we leap from that, which would be a 
focus on the big banks, to deciding that we are going to look at ev- 
erything anybody does in America based on the whim of one bu- 
reaucrat in a hidden institution which is remarkably secret, to go 
back to that term — 

Chairman Duffy. And I want to — 

Mr. Gingrich. — I think is just wrong. 

Chairman Duffy. My time is up, but pursuant to clause 4(d) of 
the committee’s rule 3, the Chair recognizes himself for an addi- 
tional 5 minutes. And I will also then recognize the ranking mem- 
ber after I am done for an additional 5 minutes. 
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To that point, Speaker Gingrich, I would agree with you. Person- 
ally identifiable information is taken by the CFPB, contrary to Mr. 
Gupta’s prior testimony. 

You would now agree, Mr. Gupta, that the CFPB does collect per- 
sonally identifiable information, correct? 

Mr. Gupta. I think a lot of things are being — 

Chairman Duffy. Yes or no? 

Mr. Gupta. — conflated here. You have to be clear. 

Chairman Duffy. Mr. Gupta — 

Mr. Gupta. The ongoing data collection that is being talked 
about — 

Chairman Duffy. I am going to reclaim my time. These are very 
specific questions. 

Mr. Gupta. — does not include personally — 

Chairman Duffy. I am going to reclaim my time. 

Mr. Gupta. — identifiable information. 

Chairman Duffy. A very simple question: Does the CFPB collect 
personally identifiable information? 

Mr. Gupta. Not as part of the — 

Chairman Duffy. Yes or no? 

Mr. Gupta. — ongoing market monitoring. The only extent — 
Chairman Duffy. So I am going to translate that for the Amer- 
ican people. The answer is: Yes, they do. 

Mr. Gupta. Only through the Consumer Complaint Database 
and through the supervision process. Those are the only ways in 
which any — 

Chairman Duffy. So you are — 

Mr. Gupta. — personally identifiable information comes in. 
Chairman Duffy. I don’t care about — 

Mr. Gupta. And it is scrubbed before it is used by the Bureau. 
Chairman Duffy. — the parameters, Mr. Gupta, by which you in- 
dicate they collect. They do collect. And GAO in their study said, 
under arbitration cases, they collect personally identifiable infor- 
mation; deposit advance products, they collect personally identifi- 
able information; and storefront payday loans, they collected per- 
sonally identifiable information. 

So they do collect it, and they do put the American consumer at 
risk. That is when they have the information, and that is not even 
talking about how we can reverse-engineer the data points that 
they do have — 

Mr. Gupta. Mr. Chairman, if I may — 

Chairman Duffy. — to subject the American people to cyber at- 
tacks. 

Mr. Gupta. Those three examples are the only ones that they 
found. The arbitration study was mandated by Congress. There is 
no other way to do it if you don’t get the arbitration cases — 

Chairman Duffy. I am going to reclaim my time. That is very 
different than what you tried to first say to this committee, which 
was that it wasn’t collected, and to now your clarified statement, 
it is collected. 

Dr. Calabria? 

Mr. Gupta. No, what I said was that — 

Chairman Duffy. I am done with — 

Mr. Gupta. — none of the ongoing market monitoring — 
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Chairman Duffy. Thank you, Mr. Gupta. 

Mr. Gupta. — collections include personal information. 

Chairman Duffy. Dr. Calabria? 

Mr. Calabria. I just wanted to make two quick points. 

One was on the notion of oversight. If we said that somehow 
Jamie Dimon is responsible to JPMorgan because he appeared in 
front of his board twice a year, we would think that was ridiculous. 
If we said that he was accountable because he appeared before his 
regulator twice a year, we would say that is ridiculous. So the no- 
tion that hearings are somehow what constitutes accountability, 
and that is sufficient for an agency, I think is, with all due respect, 
absurd. 

But, more importantly, I want to get to the notion of — we had a 
financial crisis. It was painful. Everybody agrees with that. Mr. 
Gupta lists in his testimony a number of things on the first page 
that the CFPB has done. Not one was the cause of the financial 
crisis. 

In fact, when the CFPB had an opportunity to deal with the 
cause of the financial crisis in its qualified mortgage rule, it 
punted. It gave up on checking credit, it gave up on downpayments. 
Congressman Frank sat before this dais a year-and-a-half ago and 
said that the most important part of Dodd-Frank, the mortgage 
rules, were essentially gutted. 

So, essentially, if we want this agency to actually do something 
about the financial crisis, we have to recognize the financial crisis 
was not caused by payday lending, it was not caused by arbitration 
clauses; it was caused by shoddy mortgages. And, again, in that in- 
stance, the CFPB — 

Chairman Duffy. By chance — 

Mr. Calabria. — completely punted. 

Chairman Duffy. — from the GSEs? 

Mr. Calabria. Yes. Again, GSEs are exempt. FHA is exempt. We 
have basically said, anybody who had anything to do with the cri- 
sis, with the exception of mortgage brokers — 

Chairman Duffy. Is exempt. 

Mr. Calabria. — is exempt from the CFPB. So let’s not pretend 
that this agency has almost even a loose connection to the financial 
crisis. 

Chairman Duffy. I find it hard to wrap my head around the fact 
that, if you are accountable to the American people by way of the 
Congress and through appropriations, if you disclose not just the 
data that you collect but the purpose for that data — for what are 
you using it? 

The NSA has been very clear on the parameters on which they 
use the data points that they collected on phone records. Tell me 
if you disagree that the CFPB has not set out bright guidelines for 
how this data is going to be used. They have told us a few of the 
things it will be used for, but, Mr. Abernathy, would you agree that 
they haven’t been clear on how and the limitations in which this 
data can be used? 

Mr. Abernathy. That is one of the most significant concerns we 
have, that they gather in enormous amounts of information, keep 
the data in house, and then they parse out only the pieces of it that 
will establish the positions that they have already taken. 
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It is like being in a court case where the prosecutor says, here 
is the information I am going to share, which shows that you are 
guilty, but you don’t have access to the other information I have 
that might tell a different story. 

Chairman Duffy. Thank you. 

And I want to go to Mr. Gingrich, Speaker Gingrich, for one 
quick second before my time expires. 

The CFPB, whether you like it or not, has been empowered to 
make rules. And I want to make sure that the rules that they 
make are good rules, that they actually help the American con- 
sumer and they help the American people. 

But, Mr. Gingrich, do you think that they could obtain good data 
by way of sampling as opposed to bulk data collection? I know that 
you in campaigns have looked at a lot of polling data that is pretty 
representative of the country as a whole. Could we have the same 
impact if we were sampling as opposed to long-term bulk data col- 
lection? 

Mr. Gingrich. I think it depends on what you are trying to ac- 
complish. If what they want to know is if there are patterns that 
should be looked at, you could do all that by polling. 

But what you are seeing — if you just think about the logic of 
what they are now doing, what you are seeing is an effort to as- 
similate all of the consumer behavior of the United States into one 
analyzable system for the purpose of a group of bureaucrats mak- 
ing a decision about whether or not it is an acceptable behavior. 

Now, that is a very practical thing if you are in their shoes. They 
would like to have the entire economy at their fingertips so they 
have control so they can decide which parts of the economy are in- 
appropriate. I think that is really, really dangerous. 

Chairman Duffy. And my time has expired. 

I now recognize for an additional 5 minutes the ranking member, 
Mr. Green. 

Mr. Green. Thank you very much, Mr. Chairman. 

Let’s go to you, Mr. Gupta. Now, Mr. Gupta, would you make the 
distinction between market monitoring and the supervisory activi- 
ties with reference to enforcement? 

Mr. Gupta. Yes. Would you like me to elaborate on that? 

Mr. Green. Is the CFPB allowed to collect identifiable informa- 
tion for market monitoring? 

Mr. Gupta. It is not. The Dodd-Frank Act makes that illegal, and 
the GAO found that the CFPB is obeying the law. 

Mr. Green. And if someone has information to the contrary, if 
you have information indicating that the CFPB is collecting identi- 
fiable information for the purpose of market monitoring, would you 
kindly raise your hand? 

All right, Mr. Abernathy. 

Mr. Abernathy. One of our concerns is that we don’t know what 
the Bureau is collecting — 

Mr. Green. But you don’t know — 

Mr. Abernathy. — and what they are using it for. 

Mr. Green. But my question to you is — 

Mr. Abernathy. We don’t know. 

Mr. Green. — do you have any evidence of it actually happening? 

Mr. Abernathy. No one in America — 
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Mr. Green. You don’t have any evidence of — 

Mr. Abernathy. — knows what the Bureau — 

Mr. Green. So you will now use conjecture and speculation to in 
some way skew this issue such that people would be confused. 

That is what this hearing is all about: confusing the American 
people so that they will now want to end the CFPB that happens 
to be a benefit to them. 

And Mr. Gingrich has gone so far as to say in his testimony that 
it is imperative that we move toward abolishing the Consumer Fi- 
nancial Protection Bureau — abolishing it, which, by the way, is the 
same desire of some of these entities that he works for. 

It is important for the American people to know who is working 
on their behalf. And you can confuse the American people with 
enough of this rhetoric that we have heard today, and they will be 
absolutely opposed to an entity that benefits them, has sent back 
all of this money to them, some $11 billion in relief to consumers. 
This would all be evaporated. It would just go away. They wouldn’t 
have an opportunity to get the money back that they overpaid or 
the money that they suffered a loss with reference to some kind of 
fraud or scam. They would just be scammed. They would be de- 
frauded. 

The personally identifiable information is used so that we can 
send the money to people. 

Mr. Gupta, do you agree with this? 

Mr. Gupta. I agree wholeheartedly. 

Mr. Green. And, also, we might add that, as we go through this 
process, it is very interesting that there seems to be a sort of a 
stealth campaign that is taking place under the radar — entities 
that can’t be properly identified; you don’t know who is on the 
board of directors, if there is a board of directors; massive amounts 
of money going to a 501(c)(3); an entity indicates that it is going 
to spend over a million dollars to take out certain Members of Con- 
gress. All of these things are happening just to make sure that the 
CFPB is emasculated and eviscerated if possible. 

This is unbelievable. I agree with the ranking member; it is hard 
for me to get my mind around some of the things that are going 
on here. The people of this country are absolutely being fed bad in- 
formation. Yes, they are intelligent; yes, they are smart; yes, they 
can sift the sand and find pearls of information, but they can’t do 
it if they are getting bad information. 

And that is what this is all about, which is why we have put so 
much emphasis on what has happened with reference to this 
stealth organization, this mystery organization. 

And, to this end, I would like to correct one thing. I said 
501(c)(3), and it is a 501(c)(4) organization. And there is so much 
more to be said, but I do want to add into the record a news article 
styled, “Gingrich-Connected PR Firm Issues Baffling Response to 
WSJ Disclosure Failure.” And this is where the amplification had 
to take place. 

And I would also want to note that, in this Mother Jones article, 
there is an indication that the Wise Public Affairs Group set up 
this Coalition, this Consumer Coalition, so-called Consumer Coali- 
tion, and that the members of the staff seem to double as members 
of the Coalition. 
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Does anybody know of any board of directors, any member of a 
board of directors associated with this Coalition? If you know of a 
board member, raise your hand. 

No one seems to. It is a mystery. 

I yield back the balance of my time. 

Chairman Duffy. The gentleman yields back. 

I want to thank our witnesses for their testimony, and for the 
rigorous debate that took place today. 

The Chair notes that some Members may have additional ques- 
tions for this panel, which they may wish to submit in writing. 
Without objection, the hearing record will remain open for 5 legis- 
lative days for Members to submit written questions to these wit- 
nesses and to place their responses in the record. Also, without ob- 
jection, Members will have 5 legislative days to submit extraneous 
materials to the Chair for inclusion in the record. 

Without objection, this hearing is now adjourned. 

[Whereupon, at 1:00 p.m., the hearing was adjourned.] 
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Thank you Chairman Duffy and Ranking Member Green for the opportunity to testify on this 
important topic, relating directly to the accountability of the Bureau of Consumer Financial 
Protection (Bureau) and the transparency of its work. My name is Wayne Abernathy, Executive 
Vice President for Financial Institutions Policy and Regulatory Affairs at the American Bankers 
Association.^ The customers of all of ABA's member banks, from thousands of community 
banks in every congressional district in the nation, to the mid-size, regional, and money center 
banks, that together present a wide variety of business models by which they serve the wide 
variety of financial services needs of the deepest and most complex economy in the world— the 
customers of these banks are affected by the actions, policies, and decisions of the Consumer 
Bureau. 

The Dodd-Frank Act gave the Bureau of Consumer Financial Protection enormous authority and 
power over retail financial products, those who provide them, and therefore over the people 
who use them. This power comes with little more than nominal oversight and accountability. It 
would be hard to find a Federal agency where the gap between regulatory power and public 
accountability is greater. The broad authorities of the Bureau are ultimately wielded by a single 
individual who has no face-to-face peer among the hundreds of employees of the Bureau. 

In their defense. Bureau officials repeatedly assert that the Bureau is a "transparent" and "data- 
driven" agency, where policy decisions, rules, regulations, and actions are formulated in public 
view driven by the story told in the enormous amounts of information that the Bureau gathers 
from businesses and their customers. Public exposure and data are to be the checks on the 
natural tendency for such a government agency, any such agency, to stray into arbitrary action. 

I emphasize again, that the Bureau, as it is currently structured, is governed by one person with 


* The American Bankers Association is the voice of the nation’s $15 trillion banking industry, which is composed of 
small, regional, and large banks that together employ more than 2 million people, safeguard $12 trillion in 
deposits, and extend more than $8 trillion in loans. 
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no peers, no one in the agency who can address him without ultimately bending to that one 
person's policy judgment, knowing that at some point the discussion will end with, "Yes sir." 

We welcome the Subcommittee's inquiry into the question of just how strong a check on 
arbitrary behavior are the Bureau's data practices and the public's access to the full information 
on which the Bureau relies for its decisions. How much is the Bureau, in fact, data-driven, and 
by which data, from which sources, and how would we know? 

Here are some things that we do know: 

Bureau officials have devoted significant effort to promote public recognition that the Bureau 
places a high priority on the role of data in policymaking and the importance of transparency 
in the use of those data. A few examples: 

• Bureau Director Richard Cordray stated the following, on September 11, 2013, in 
remarks before the American Mortgage Conference: "At the Consumer Bureau, we are 
a data-driven agency. Before we finalize our rules, we conduct research and solicit input 
from all stakeholders— consumer advocates, industry members, and public officials. The 
best decisions will be those that are best informed."^ 

• A year earlier, on May 3, 2012, Richard Cordray said the following at the Simon New 
York City Conference: "we have dedicated ourselves to being an agency that is 
evidence-based and data-driven. Field hearings, inquiries, rulemakings, bulletins— we 
are taking an ‘all of the above' approach to guarantee that we are both sharing and 
receiving up-to-date information that will inform our policymaking. . . . We strive to be 
as rigorous and analytical as the available market information allows us to be while 
remaining pragmatic in our judgments and decisions."^ 

• On December 13, 2012, Richard Cordray offered the following on a press call to discuss a 
white paper on credit reporting: "As a data-driven agency we believe in informational 
reports like this. We believe in doing deep dives into the markets we regulate, because 
we think the best and most effective way to oversee an industry or market is to 
understand it thoroughly."'' 

• The Bureau's Strategic Plan for FY2013-FY2017 includes the following: "We take in data, 
manage it, store it, share it appropriately, and protect it from unauthorized access. Our 


Richard Cordray, Director, Bureau of Consumer Financial Protection, Remarks at the American Mortgage 
Conference (Sept. 11, 2013), available at: director-cordray-remarks-at-the-american-mortgage-conference. 

’ Richard Cordray, Director, Bureau of Consumer Financial Protection, Prepared Remarks Before the 2012 Simon 
New York City Conference (May 3, 2012), available at: http://www.consumerfinance.gov/newsroom/prep 3 red- 
remarks-by-rich3rd-cordray-before-the-2012-simon-new-york-city-conference/. 

“ Richard Cordray, Director, Bureau of Consumer Financial Protection, Prepared Remarks on a Credit Repotting 
White Paper Press Call (Dec. 13, 2012), available at: http://www.consumerfinance.gov/newsroom/preparGd- 
remarks-by-richard-cordray-on-a-credit-reporting-white-paper-press-ca!!/. 
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aim is to use data purposefully, to analyze and distill data to enable informed decision- 
making in all internal and external functions,"^ 

• This, from the Bureau's website, on a page titled, "Open Government": "Transparency 
is at the core of our agenda, and it is a key part of how we operate. You deserve to know 
what we're doing for the American public and how we are doing it."^ 


It would be difficult for anyone here to object to the goals, objectives, or principles enunciated 
in those statements. We support them. 

Bureau practices, however, have not lived up to these appropriate standards, and there is little 
to require that they do. 

The Dodd-Frank Act extends to the Bureau impressive authorities for requiring information 
and gathering data. Oversight under the Act of the exercise of those authorities is less 
impressive. The following is a summary of key provisions. 

• Section 1022(c): Monitoring Authority . The Bureau— "to support its rulemaking and 
other functions"— is authorized to exercise broad data gathering powers for the purpose 
of monitoring "for risks to consumers in the offering or provision of consumer financial 
products or services, including developments" in these markets. The statute provides 
illustrations of— but not limits on— what the Bureau should consider in using its 
resources under this provision (there is no consideration mentioned of the use of 
financial firms' resources), including (1) likely risks and costs to consumers; (2) 
understanding by consumers of risks; (3) applicable legal protections; (4) rates of growth 
in providing products and services; (5) the extent to which risks may disproportionately 
affect underserved consumers; or (6) "the types, number, and other pertinent 
characteristics" of the firms under Bureau jurisdiction that provide financial consumer 
products and services. The Bureau is required to publish at least annually a report of 
"significant findings" from this monitoring. To obtain this information, Section 1022 
authorizes the Bureau to gather data "regarding the organization, business conduct, 
markets, and activities" of the firms under Bureau jurisdiction. The Bureau may gather 
from firms under its jurisdiction information by rule or by order, under oath or 
otherwise, in such form and reasonable time period “as the Bureau may prescribe". The 
Bureau may also gather from other parties information "from a variety of sources," 
including consumers and "available databases". This section also authorizes the Bureau 
to require that non-banks that are not under its jurisdiction file with the Bureau, "under 
oath or otherwise," annual or special reports, including answers to specific questions, to 


' Bureau of Consumer Financial Protection, Strategic Plan FY 2013- FY 2017, mailable at : 
http :// www . caasumerfinance . gov / strategic - plan /. 

® Open Government, Bureau of Consumer Financial Protection (December 10, 2015), 
http://www.consumerfinance.gov/open/. 
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help the Bureau assess whether such firms are or are not under the Bureau's 
jurisdiction. 

• Section 1024: Exams and Reports. Large Non-Banks . The Bureau is authorized to 
require reports from and conduct periodic examinations of larger non-bank participants 
in financial consumer markets for the purposes of (a) assessing compliance with Federal 
consumer financial laws; (b) obtaining information about activities subject to such laws, 
as well as the financial firms' compliance systems and procedures; and (c) "detecting 
and assessing associated risks to consumers and markets for consumer financial 
products and services." This third purpose is broad, the limits of which remain untested 
by the courts or bound by regulations or guidelines. The Dodd-Frank Act extends to the 
Bureau authority to require these firms to "generate, provide, or retain" records to 
facilitate these examination and reporting requirements. Bureau authority also extends 
to service providers to these firms. 

• Section 1025: Exams and Reports. Larger Banks . The Bureau has exclusive authority to 
require reports from and conduct periodic examinations of banks and credit unions— 
and any of their affiliates— that have more than $10 billion in assets. This authority, 
under the statute, is to be exercised for the purposes of (a) assessing compliance with 
Federal consumer financial laws; (b) obtaining information about activities subject to 
such laws, as well as the financial firms’ compliance systems and procedures; and (c) 
"detecting and assessing associated risks to consumers and markets for consumer 
financial products and services." This third purpose is broad, the limits of which remain 
untested by the courts or bound by regulations or guidelines. Bureau authority also 
extends to service providers to these banks and credit unions. 

• Section 1026: Exams and Reports. Smaller Banks . The Bureau is authorized to require 
reports from banks and credit unions with $10 billion or less in assets (a) to support the 
role of the Bureau in implementing Federal consumer financial laws, (b) to support 
Bureau examinations of such banks and credit unions, and (c) "to assess and detect risks 
to consumers and consumer financial markets." Again, this third purpose is a broad 
catchall authority untested in court or defined by regulations or guidelines. Bureau 
authority also extends to service providers to these banks and credit unions. 

• Section 1013(b)(3): Consumer Complaints . The Bureau is directed by the Act to create 
an internal unit to establish a toll-free telephone number, a website, and a database for 
the centralized collection and monitoring of and response to consumer complaints. No 
authority is mentioned for publication of such complaints. There are requirements for 
the Bureau to route complaints to appropriate government agencies, including State 
agencies, and to provide Congress with an annual report on consumer complaints and 
their resolution. 

These authorities are expansive and intrusive. In the case of each extension of authority there 
are enumerated lines of inquiry followed by broad undefined grants, leaving little in the 
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affected firms to which the Bureau could not reach in its quest for information. Missing from 
the statute is effective oversight of the Bureau's exercise of this authority. 

Among the noteworthy elements of these provisions are the ways in which power is given to 
the Bureau to reach for data from firms outside of its jurisdiction, including authority for the 
Bureau to demand that such firms provide whatever information the Bureau deems 
appropriate to show cause why they should not be under the Bureau's jurisdiction. 

The Bureau gathers data through numerous consultative efforts. 

• In addition to these statutory authorities— as well as in connection with their exercise— 
the Bureau takes advantage of a variety of formal and informal activities to gather 
information, such as meetings and consultations with academics, think tanks, consumer 
advocacy groups, and financial firms subject to its jurisdiction. 

• The Bureau has established and consults with advisory groups, such as the Academic 
Research Council, the Consumer Advisory Board, the Community Bank Advisory Council, 
and the Credit Union Advisory Council. These advisory groups meet periodically in 
person and through conference calls, with some of their deliberations open and some of 
them closed to the public, 

• The Bureau has sought public comment through several formal Requests for 
Information (RFIs) on topics such as debit overdraft programs, arbitration, student loan 
servicing, mobile financial services, and consumer complaint "normalization." 

Problematic Bureau data practices have undermined the effective use of data to serve as a 
check on arbitrary action by the Bureau, weakened the contribution of information to the 
quality of policymaking, and undercut the role of data to prevent regulatory abuses. Taken 
together, these practices place at risk the Bureau's mission to protect consumers. The 
following are an illustrative, but not comprehensive, litany. 

• Evading PRA Public Exposure Strictures. While Cherry-Picking Data . In 2012 the Bureau 
gathered data on debit overdraft practices from 9 banks. The number selected was not 
arbitrary, since the Paperwork Reduction Act (PRA) requires prior exposure to public 
comment and a submission for review to the Office of Management and Budget (0MB) 
whenever a Federal agency seeks to collect information from 10 or more parties. 
Inasmuch as the data collection was applied to large banks, it skewed the results, 
ignoring the variety of overdraft programs exercised throughout the industry by banks 
of all sizes. The Bureau kept confidential the identities of the 9 banks surveyed, even 
discouraging the banks from publicly acknowledging their participation. The Bureau 
published in June 2013 an analysis of the data in a white paper, "CFPB Study of 
Overdraft Programs: A white paper of initial data findings." Neither the structure of the 
survey nor the data it gathered were made available for public review and comment 
other than what was selectively offered in the Bureau's white paper. The validity of the 
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Bureau's "initial data findings" could not be reviewed— let alone tested— by the public.' 
In July 2014 the Bureau again drew on this still cloistered database in a "Data Point" 
published on the Bureau's website.® The information as offered was misleading both to 
consumers who might read and act on it and to policymakers who might be tempted to 
do so, too. For example, the "Data Point" asserted that the median debit card overdraft 
in the survey was $24, causing a median overdraft fee of $34 dollars. The mean average 
of both overdrafts and fees in the sample data was and remains publicly unavailable. 
Why this matters can be shown by a George Mason University Law and Economics 
Research paper that, drawing upon data from a regional bank, reported that in the one 
year period under review the bank's customers overdrew their accounts by $437.6 
million, for which they paid a total of $58.8 million in overdraft fees, which is to say that 
overdraft credit received by customers was 7.4 times the amount of fees paid.® The 
authors of the GMU Law paper do not claim their study of one bank to be definitive, but 
they do demonstrate that the Bureau's interpretation of its 9-bank study cannot be 
taken as definitive, either. Full public disclosure of the data on which the Bureau based 
its studies would promote public analysis and regulatory policymaking that would 
benefit rather than threaten to harm consumers. 

• Skewed Data Samples . Similarly, in 2014 the Bureau, using its authority under Section 
1022, again ordered fewer than 10 banks to provide information on their credit card 
debt collection and debt sale policies and practices. And, once again, limiting the 
sample to avoid PRA public review strictures produced data skewed to large banks.'® 
Such a sample, limited to data on credit card debt collection practices, can suggest 
policy actions out of sync with the realities of debt collections by smaller banks where 
credit card accounts make up a much smaller portion of their business. Policymakers in 
Congress and in the executive branch agencies are increasingly recognizing the 
importance of tailored regulation appropriate to the variety of banking business 
models— and thereby more appropriate to the needs and interests of the variety of 
bank customers. Skewed regulatory data practices, however, employed in order to 
avoid statutory public exposure requirements, will ill-serve consumers. The Bureau will 
fall to be data-driven while such data manipulation practices prevail. 

• Avoiding Public Exposure by Abusing PRA Generic Clearance Processes . The PRA was 
enacted, "to ensure the greatest possible public benefit from and to maximize the utility 


’ Bureau of Consumer Financial Protection, CFPB Study of Overdraft Programs, A White Paper of Initial Data Findings 
(June 2013), available at http://fiies.consumerfinance.gOv/f/201306_cfpb_whitepaper_overdrafE-practices.pdf. 

^ Bureau of Consumer Financial Protection, Data Point: Checking Account Overdraft (July 2014), available at 
http://fiies.consumerfinance.gOv/f/201407_cfpb_report_d3ta-point_overdrafts.pdf. 

G. Michael Flores and Todd J. Zywicki, Commentary: CFPB Study of Overdraft Programs, George Mason University 
Law & Economics Research Paper No. 13-60 (Nov. 4, 2013) at 7, available at 
http://papers.ssrn.com/sol3/p3pers.cfm7abstr3ct id=2349819 . 

Bureau of Consumer Financial Protection, The Consumer Credit Card Market Report 237 (December 2015), 
available at htto://files.consumerf!nance.eov/f/201512 cfob report -the-consumer-credit-card-market. pdf . 
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of information created, collected, maintained, used, shared and disseminated by or for 
the Federal Government" and "to improve the quality and use of Federal information to 
strengthen decision making, accountability, and openness in Government and 
society."'^ Evading application of the PRA, therefore, evades fulfillment of these 
important purposes in government policymaking. Besides sidestepping PRA 
requirements by seeking data from fewer than 10 parties, the Bureau also makes 
extensive use of the PRA's Generic Clearance process to avoid public scrutiny. Under 
this simplified procedure (normally used for customer satisfaction surveys, focus group 
testing, and website usability surveys),'^ agencies can obtain expedited and advance 
sign off for information requests— with little or no public awareness of what they are 
doing and therefore little or no opportunity to comment on the effectiveness of the 
proposed survey research. In November 2011, the Bureau obtained Generic Clearance 
under PRA for the innocuous and bureaucratic sounding project, "Generic Clearance for 
Development and/or Testing of Model Forms, Disclosures, Tools, and Other Similar 
Related Materials". Once the Bureau obtained the rather routine 0MB Generic 
Clearance for the project, the Bureau subsequently used it 13 times for qualitative 
testing, including projects relating to consumer decision-making on debit card and ATM 
overdraft options.'^ These 13 information requests were obscured from public review 
and comment, frustrating the PRA’s objectives "to strengthen decision making, 
accountability, and openness in Government and society," objectives that are consistent 
with the Bureau's public image as a "data-driven agency". 

• Misrepresenting Overdraft Data Gathering . In January 2013, 0MB approved the 
Bureau's request for "Generic Clearance for Qualitative Consumer Education, 
Engagement, and Experience Information Collections" under the PRA, The Bureau 
conducted 17 separate information collections under this approval, with little public 
awareness. One was a survey on checking account debit programs, beginning with an 
initial sample of 10,000 households, leading to in-depth, one-hour interviews with 100 
overdraft users. Astonishingly, the Bureau certified that the information collected from 
this overdraft survey would "not be used for the purpose of substantially informing 
influential policy decisions,"” a statement that may overdraw the Bureau's credibility 


“ 44 U.S.C. § 3501. 

Office of Management and Budget Memorandum, Information Collection under the Paperwork Reduction Act 
(April 7, 2010) at 5, available at 

http://www.whitehou5e-gov/sites/defauit/fiies/omb/assets/inforee/PRAPrimer 0407201Q.Ddf . See also Office of 
Management and Budget Memorandum, Paperwork Reduction Act - Generic Clearances (May 28, 

2010}("" Clearances of generic ICRs provide a significantly streamlined process by which agencies may obtain 
OMB's approval for particular information clearances - usually voluntary, low burden, and uncontroversial 
collections.. ..including methodological testing, customer satisfaction surveys, focus groups, contests, and website 
satisfaction surveys."(emphasis added)). 

See Info. Collection List filed pursuant to Information Collection Request Package, 0MB Control No. 3170-0022, 

available at htto://www.reginfo.eov/oublic/do/PRAICList?ref nbr=2Q12Q6-3170-002 . 

M 

Qualitative Research of Consumer Understanding and Decision-making Related to Overdrafts, Request for 
Approval Under the "Generic Clearance for Qualitative Consumer Educ., Engagement, & Experience Info. 
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account. Consider that elsewhere in the Bureau’s description of the overdraft survey it 
reports that the Bureau is planning "a series of one or two additional white papers" on 
overdraft, and that the survey "will inform our interpretations of the quantitative data 
in these white papers."'^ Bureau officials have long announced overdraft programs to 
be on their list of issues for regulatory policy review. Such hide-the-ball information 
practices frustrate rather than promote the "all of the above" approach promised by 
Richard Cordray in 2012 to "guarantee that we are both sharing and receiving up-to- 
date information that will inform our policymaking". 

• Publication of Unverified Complaints . The Bureau continues to publish on its official 
website, at the top of which are the words, "An official website of the United States 
Government", consumer complaints that are unverified for accuracy or veracity. As 
noted above. Section 1013 of the Dodd-Frank Act directs the Bureau to gather consumer 
complaints and direct them to the appropriate agencies to promote their resolution. 
Neither the Dodd-Frank Act nor any other provision of Federal law, however, authorizes 
the Bureau to publish this unverified information. The Bureau asserts that, "By adding 
their voice, consumers help improve the financial marketplace."^® But how can this be 
true if the information provided, with a U.S. Government imprimatur, is unreliable and 
misleading? What does the Bureau offer to protect a consumer from acting on 
erroneous information published on the Bureau's website? 

• Ignoring its Own Data: the Arbitration Study . Section 1028 of the Dodd-Frank Act 
requires the Bureau to study arbitration provisions in the agreements that financial 
firms have with their customers. The Bureau is then to take regulatory action, if 
appropriate, based upon the findings of that study. In March 2015, the Bureau 
published its study.^^ In this case, the Bureau gave significant public access to the 
complement of data on which it based the study's findings. That access revealed that in 
important aspects the data were inconsistent with those findings. One such finding is 
that consumers are better protected under class action lawsuits than they are under 
arbitration. The data in the study tell a different story. For example, they show that 
arbitration resolves customer disputes up to 12 times faster than do lawsuits. According 
to the supporting information in the Bureau study, the average time for resolution by 
arbitration varied from 4 months to 7 months (depending on the form of arbitration 
used).'® The same data showed that the average time for resolution by class action 
lawsuit varied from 1.89 years and 2.07 years (the latter being the average for multi- 
district litigation).'® Further, consumers obtained an average of $32.25 via class action 


Collections" p. 6(OMB Control No.: 3170-0036), available at 
http://www.reginfo.gov/public/do/PRAViewlC?ref_nbr=201404-3170-001&iciD. 

Id. at 1. 

Consumer Response Database home page, available at http://www.consumerfinance.gov/compiaint(jat8base/ . 
Bureau of Consumer Rnancial Protection, Arbitration Study (March 2015) available at 
http://files.consumerfinance.aov/f/201503 cfpb arbitration-studv-repon-to-conaress-2015.pdf . 

Id. §4, p. 72-73. 

Id. §6, pp.9, 43. 
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settlements according to the Bureau data, while arbitration relief to consumers 
averaged $5,389.™ Were the Bureau to take regulatory action based upon findings that 
are contradicted by its own data, it would arguably leave itself vulnerable to legal 
challenges for acting in an arbitrary and capricious manner. Hopefully, the public 
exposure of the data behind the Bureau's study, and the public scrutiny that this 
exposure allows, will result in Bureau action fully consistent with the data and therefore 
with consumer interests. That is do say, that public disclosure of the data behind 
policymaking can militate against Bureau action taken contrary to the facts. 

• Manufacturing Data that Do Not Exist: Indirect Auto Lending . The work of the full 
Committee and this Subcommittee has already developed a strong record exposing the 
problems with the Bureau's data practices relating to indirect auto lending. In 
mentioning that work I note that it further supports arguments that I have raised in this 
testimony. I would only add, by way of emphasis, that transparency and accountability 
also require access to the Bureau's research methods and assumptions. This is perhaps 
demonstrated nowhere more clearly than in the Bureau's efforts to manufacture fair 
lending data where they do not exist. In well publicized enforcement cases, the Bureau 
asserted illegal discrimination in auto lending where no data are actually collected on 
race or national origin of customers. In fact, lenders are forbidden by law from 
collecting such information, specifically in order to avoid it from being a factor in lending 
decisions. On March 21, 2013, the Bureau published Bulletin 2013-02, "Indirect Auto 
Lending and Compliance with the Equal Credit Opportunity Act," in which it warned 
that, "there is a significant risk that" indirect auto lending practices "will result in pricing 
disparities on the basis of race, national origin, and potentially other prohibited bases." 
The Bulletin disclosed neither data nor the analytical processes substantiating that 
warning.^^ Following significant controversy, the Bureau published in September 2014 
its methodology for developing data to support its concerns.^^ Further disclosures in 
the media and by the full Committee have shown that when the Bureau methodology 
was tested against mortgage data (where race and national origin of borrowers is 
known because law requires lenders to record and report it), only about half of the 
people identified by the Bureau's methodology to be African-American were in fact 
African-American. Bureau memos leaked to the press suggest that this error rate has 
long been known to the Bureau. Greater public access to the information on which the 
Bureau relies In making public policy would improve the quality of policymaking and 
would be consistent with a truly data-driven agency. 


The Arbitration Study states that cash payments to "at least 34 million consumers" during the period studied 
were "at least $1.1 billion." This means that the average class member's recovery was a mere $32.35. 

Bureau of Consumer Financial Protection Bulletin 2013-02, "Indirect Auto Lending and Compliance With the Equal 
Credit Opportunity Act" (March 21, 2013), available at http://file5.consumerfinance.gOv/f/2Q1303 cfpb march - 
Auto- Finance- Bulletin, pdf . 

Bureau of Consumer Financial Protection, Using Publically Available Information to Proxy for Unidentified Race and 
Ethnicity: A Methodology and Assessment (Summer 2014), available at 
http://fiies.consumerfinance.gOv/f/201409 cfpb report oroxv-methodQlQgv.odf . 
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Recommendations 

In light of these problems, ABA makes the following recommendations for consideration and 
action by the Congress, 

1. Section 1022 of the Dodd-Frank Act should be amended to place appropriate oversight, 
accountability, and reasonableness requirements on how the Bureau uses that authority 
to obligate data submissions. Reform efforts should take up a mandate that the Bureau 
consider and document (1) the value and importance of information it requests, and (2) 
whether the data are duplicative of other collections or of otherwise available 
information. The Section would be improved by including a process whereby a recipient 
of an order may challenge or seek to limit the breadth of the order. The Bureau's 
annual report under this section should also include a summary of each use of the 
authority for the previous year and the cost to the private sector for complying with 
each request. In addition, Congress should consider a requirement that the Bureau 
provide the private sector offsetting compensation for the costs of producing and 
submitting information under Section 1022. 

2. The public should be given full and ample access to the de-identified information and 
data relied upon by the Bureau in its rulemaking, policymaking, and policy-related 
reports. Access to such data should be a standard part of the public comment process 
prior to making final decisions, allowing for liberal public review and analysis relating to 
the complete story that the information may tell. 

3. A study should be conducted, such as by the Government Accountability Office, of the 
use by the Bureau of the Generic Clearance process under the Paperwork Reduction Act 
(PRA), to identify whether Bureau practices are appropriate and in line with the 
purposes of that clearance process and the public transparency and accountability 
objectives of the PRA. 

4. The governance of the Bureau should be changed from a sole directorship to 
governance by a bipartisan commission, similar to the structure of the Securities and 
Exchange Commission, the Commodity Futures Trading Commission, and other 
independent agencies. In this way, data practices would be subject to governance and 
review (and a diversity of perspectives) by Bureau commissioners with comparable 
stature and authority within the agency, who can ensure that pubiic disclosure of data is 
provided in full and ample context consistent with public review, oversight, and 
accountability. 


Conclusion 

I wish to emphasize our fourth recommendation as the most important of the four. With a 
commission structure, composed of a bipartisan council of policymakers, there is less room for 
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abusing data, and less opportunity to do so as well. Under the light of the variety of viewpoints 
that comes with a council or a commission, you have different people posing different 
questions from differing backgrounds and insights, all more likely to poke and prod the data, 
and all of them likely to be intolerant of information legerdemain. 

On behalf of ABA and its member banks of all descriptions and business models, serving 
hundreds of millions of people— our customers and your constituents— impacted by policy 
decisions made by the consumer Bureau, I want to thank the Subcommittee for this important 
inquiry. I would be happy to respond to any questions you may have. 
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Chairman Duffy, Ranking Member Green, and distinguished members of the 
Subcommittee, I thank you for the invitation to appear at today's important hearing. I am Mark 
Calabria, Director of Financial Regulation Studies at the Cato Institute, a non-profit, non-partisan 
public policy research institute located here in Washington, D.C. Before 1 begin my testimony, 1 
would like to make clear that my comments are solely my own and do not represent any official 
positions of the Cato Institute. In addition, outside of my interest as a citizen, consumer and 
taxpayer, I have no direct financial interest in the subject matter before the Committee today, nor 
do 1 represent any entities that do. 

I will also note that my service at HUD included supervising and managing HUD’s 
enforcement of the Real Estate Settlement Procedures Act (RESPA). These responsibilities, 
along with the relevant HUD staff, were transferred to the CFPB. Accordingly the views 1 will 
offer today are not simply those of an analyst but also of one who has attempted to make our 
financial consumer protection laws more effective. 
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Is CFPB’s Massive Data Collection Required? 

I believe it would be unfair to criticize any agency for simply following mandates 
imposed upon it by Congress. If such mandates are problematic, then the blame rests with 
Congress. Agencies should, however, be held responsible for their implementation and whatever 
discretionary policies and actions they pursue beyond Congressional mandates. I submit to the 
Subcommittee that the manner and extent of CFPB’s data collection program goes far beyond 
what required under the Dodd-Frank Act. The objectives and requirements of Title X of Dodd- 
Frank can easily be achieved with more narrow and targeted methods. 

Let us review the CFPB’s data mandates: 


Section 1013 establishes the administrative structure of the CFPB. More precisely as it relates to 
data collection, 1013(b) established specific function areas, including research: 

1013(b)(1) Research -The Director shall establish a unit whose functions shall include fesearching„ analyzing, and reporting 

on — 

(A) developments in markets for coasumcr financial products or scrvicc.s, including market areas of alternative consumer financial 
products or services with hi^ growlh rates and areas of risk to consumers; 

(B) access to fair and affordable credit fw traditionally underserved communities; 

(C) consumer awareness, understanding, and use of disciosurc-s and eommunicalions regarding consumer financial products or 
services; 

(D) consumer awareness and understanding of costs, risks, and benefits of consumer financial prtxlucts or services; 

(E) consumer behavior w'ith respect to consumer financial products or services, including performance on mortgage loans; and 

(F) experiences of traditionally underserved consumers, including un-b^ked and under-banked consumers. 


None of the preceding activities requires micro-level transactional data. Nowhere in the 
above are the current data collection efforts mandated or even suggested. As an economist 1 
certainly understand the desire for researchers to have extensive transaction level data. 
Agencies, however, are not constructed for the enjoyment of researchers, but to achieve a 
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specific public purpose. All of the above areas can be addressed with aggregate level data, most 
of which is already publicly available. 

While 1 0! 3(b)(3) establishes collecting and tracking consumer complaints, such is an 
activity entirely separate from overall market monitoring. And while 1 believe consumers could 
be given more disclosure on what is done with the information they submit as part of the 
complaint process, the fact remains that complaints are submitted voluntarily. Nowhere in 
1013(b)(3) is there a requirement for massive non-complaint data collection. Nor will one find 
such data efforts listed under 1013(c) which establishes CFPB’s Office of Fair Lending and 
Equal Opportunity. 

One might wonder if such a mandate is found elsewhere in Title X. The functions of the 
CFPB do mention under Section 1021(c) the “collecting, researching, monitoring, and publishing 
information relevant to the functioning of markets for consumer financial products and services 
to identify risks to consumers and the proper functioning of such markets”. While the term 
“infomiation” is indeed broad. I find it difficult to believe that such could be read to mandate the 
large scale collection of transactional data. In fact individual transactions tell you almost nothing 
about the overall functioning of specific markets. 1021(c) is easily fulfilled by collecting 
aggregate data and information published by private and other government sources. 

Nor do the monitoring responsibilities under 1022(c) require the collection of massive 
amounts of transactional data. In fact the monitoring under 1 022(c) can be achieved by any 
competent regulator with the use of aggregate data. There is zero need for transaction level data 
to fulfill the purposes and objectives of 1 022(c). 
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1 was certainly able, when managing HUD’s RESPA activities, to aggressively enforce 
RESPA and even undertake a major revision of the rules under RESPA, without engaging in the 
collection of massive amounts of transactional data. It can be done. What difficulties 1 ran into 
were almost always a result of the statute, not a lack of data. 

To summarize, outside of the consumer complaint database, which has problems of its 
own’, the large scale collection of transactions data by the CFPB is not mandated by statute or 
necessary to carry out its statutory responsibilities. 


CFPB - Data protection, privacy and the Fourth Amendment 

Passed in the aftermath of the terrorist attacks of 9/1 1 , the Patriot Act vastly expanded the 
data collection efforts of the U.S. government. The public was told that only if we had had more 
data, the attacks could have been avoided. Yet the intelligence failures were not from lack of 
data, but from an inability (or unwillingness) to “connect the dots”. Similarly the financial crisis 
was met with demands for “more data” as if the overheated housing and mortgage markets were 
not obvious enough from the generally available aggregate data. 

Before turning to the CFPB, let me clearly state that the privacy and Fourth Amendment 
issues raised are not unique to the CFPB. 1 believe the “third party doctrine” upon which this 
data collection rests is fundamentally flawed and simply inconsistent with the Forth Amendment. 
My colleagues at the Cato Institute and I have regularly and consistently expressed concerns as 


’ See Rachel Witkowski "Errors Abound in CFPB's Complaint Portal” American Banker November 17, 2015. 
http://www.3mencanbanker-com/new5/law-reeulatton/errors-abQund-in-cfpbS'Comptaln t-portai.l077878-l.html 
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to collection of consumer data by government officials. We have done so regardless of the 
politics or whether we supported the objectives of the agency in question. The Cato Institute has 
submitted a number of legal briefs on the issue, most recently in City of Los Angeles v. Patel," 
decided last term before the Supreme Court. 1 would also point you to our submissions in Riley 
V. California,^ Heien v. North Carolina^ and Nelson v. City of Rochester f 

We have also repeatedly seen the harm from both the regulatory burden and over- 
collection of data by other financial regulators. I applaud, for instance, Congressman Ellison’s 
efforts on last year’s Money Remittances Improvement Act (H.R. 4386). Such reduced data 
collection burdens in remittance market and did so without sacrificing consumer or national 
security protections. 1 believe it can serve as a model for the efforts of the CFPB. 

Turning back to the CFPB, the GAO has reported that the CFPB has engaged in at least 
12 large scale data collection efforts.'^ At least 3 include information that directly identifies 
individual consumers. Combining this information with other sources allows most of the 
remaining data collections to also identify individual consumers.^ 


^ See Cato Institute. City of Los Angeles v. Patel Legal Brief httD://www.cato. org/pubiications/legal-briefs/citv-los- 
angeles-v-oatel 

^ http://www.catQ.ore/publications/ieeal-briefs/rilev-v-californi3 

htto:/ /ww w.cato.ore/pub li cations/legai.br ie fs/heien-v-north-caroMna 

^ httD://www.cato.org/publications/ieea |. brief$/nelson.v.citv-roche5ter 

Government Accountability Office. 2014. Consumer Financial Protection Bureau: Some Privacy and Security 
Procedures for Data Collection Shouid Continue Being Enhanced. Report to Congressional Addresses GAO'14.758 

’ See Yves-Alexandre de Montjoye, Laura Radaeili, Vivek Kumar Singh and Alex Pentland. 2015. "Unique in the 
Shopping Mall: On the Reidentifiability of Credit Card Metadata,” Science #6221. 
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While some of these collections are relatively small, such as the 1 1,204 arbitration case 
records, the Bureau's collection of mortgages, credit report and credit card data is quite 
extensive. Combined with the CFPB's information sharing agreement with the Office of the 
Comptroller of the Currency, the CFPB has access to almost 90 percent of outstanding credit 
card balances. 

As a fonner federal employee and one subject to the recent Office of Personnel 
Management breach, let me clearly say 1 do not trust the CFPB with protecting my personal 
financial data from hackers. As both GAO and the Federal Reserve Inspector General (OIG)* 
have recognized, the CFPB’s data collect poses significant privacy risk to consumers and 
remains in need of improvement. In consolidating all this financial information in one place, the 
CFPB has left consumers extremely vulnerable to identity theft and even extortion from hackers. 

A particular vulnerability is the heavy reliance of the CFPB on outside contractors or 
contractor-controlled systems. A noted by the OIG, the CFPB continues to “face challenges in 
ensuring that contractors implement information security controls that meet agency 
requirements.”'’ These risks are compounded by the CFPB’s heavy reliance on “cloud” based 
computing systems, which are especially vulnerable to hacking. To the extent that the CFPB 
continues to engage in mass data collection, such should be brought “in-house” and not entrusted 
to private contractors. 


See Office of the Inspector General, Federal Reserve, Major Management Challenges for the Consumer Financial 
Protection Bureau September 30, 2015, http://oie.federalreserve.eQv/reports/cfpb-management-chajlenees.htm 

’ See Office of the Inspector General, Federal Reserve, Major Management Challenges for the Consumer Financial 
Protection Bureau September 30, 2015. 
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The risk of hacking is a threat from outside the Bureau. Unfortunately the CFPB’s data 
collection, particularly in the area of credit cards, poses significant threats to our fourth 
amendment protections. As .lustice Douglas observed in his dissent to California Bankers Assn 
V. Shultz, “A checking account... may well record a citizen’s activities, opinions, and beliefs as 
fully as transcripts of his telephone records.” Credit cards are today’s checks. As GAO noted, 
the CFPB is not simply collecting account information, which would be bad enough, but also 
transaction level information. In its brief to California Bankers Assn, the American Civil 
Liberties Union (ACLU) noted that accessing financial records could allow its membership to be 
identified, eroding the protections recognized in NAACP v. Alabama. As an employee of an 
in.stitute that also receives donations transmitted via checks and credit cards, I too fear that 
allowing government access to such records poses a significant threat to our political freedoms. 
As Justice Marshall observed in his dissent to California Bankers Assn., “The technique of 
examining bank accounts to investigate political organizations is, unfortunately, not rare.” 

Such concerns are not simply reflections of the Watergate era. As recently as 2012, 
Justice Sotomayor in her concurrence to United States, Petitioner v. Antoine Jones, correctly 
observed that “Awareness that the Government may be watching chills associational and 
expressive freedoms. And the Government’s unre.strained power to assemble data that reveal 
private aspects of identity is susceptible to abuse.” Justice Sotomayor offers the example of 
medications purchased by online retailers as an example. Such a purchase could potentially be 
identified within the CFPB’s database of credit card accounts. 

For a variety of reasons, the CFPB has become a highly partisan issue. Were it to use the 
financial records of its critics in an attempt to silence or intimidate these critics, it would not be 
the first agency to do so. 
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While today’s hearing is not about the overall structure of the CFPB, we should 
recognize that its current structure, that of a single director, leaves it especially vulnerable to the 
cognitive biases that contribute to civil liberties abuses.'® A large body of research on group 
decision-making suggests that a lack of mechanisms for mandated dissent can result in tunnel 
vision." While of course speculative, 1 would suggest that the worst abuses of, for instance, .1. 
Edgar Hoover, would have been avoided or minimized had the FBI operated as a board and/or 
been subject to additional checks and balances.'" Just as we now know recognize that a single- 
minded focus on fighting communists, terrorists, the mafia or drug dealers (or whoever the 
villain of the day is) can result in the abuse of civil liberties, so can a single-minded focus on 
fighting “financial abuse”. Siding with the Constitution is no more siding with “abusive lenders” 
than it is siding with terrorists or drug dealers. 

Unlike many other law enforcement agencies, the CFPB lacks some basic safeguards. 

For instance no subpoena or warrant has been issued for its massive data collection efforts. As 
Justice Douglas has explained, a neutral third party, such as magistrate, is needed to balance the 
pressures of law enforcement with protection of our constitutional freedoms. In McDonald v. 
United States, Justice Douglas expressed this view of the Founders' intent: “The right of privacy 
was too precious to entrust to the discretion of tho.se whose job is the detection of crime and the 
arrest of criminals. Power is a heady thing; and history shows that the police acting on their own 

“ See generally, Rachlinski, Jeffrey J, and Farina, Cynthia R., "Cognitive Psychology and Optimal Government 
Design” Cornell Low Review, vol. 87, no. 2 (January 2002). 

” See Cass R. Sunstein, "Conformity and Dissent" (University of Chicago Public Law & Legal Theory Working Paper 
No. 34, 2002). 

For examples of some of these weil-know abuses, see Curt Gentry, J. Edgar Hoover: The Man and the Secrets. 
Norton 2001; or Tim Weiner. Enemies: A History of the FBI. Random House 2013. 
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cannot be trusted.” The CFPB lias repeatedly characterized itself as a “cop on the beat”. It is 
long past time that it is subjected to the same constraints and oversight as a “cop on the beat”. 
The abuses witnessed in law enforcement should remind us all what happens when government 
is driven by a single-minded, unrestrained, focus on eliminating legal violations. 

While other financial regulators also collect large amounts of data, and we should be 
concerned about those efforts as well, GAO has observed the efforts of other financial regulators 
are “less extensive than CFPB’s data collections.” For instance neither the Securities and 
Exchange Commission nor the Commodity Futures Trading Commission engages in the 
collection of massive amounts of individual investor data. 

The Federal Trade Commission (FTC) and the Consumer Product Safety Commission 
(CPSC), to which the CFPB is often compared, also lack the extensive data collection efforts of 
the CFPB. The FTC and CPSC do build databases of complaints they receive from consumers, 
as does the CFPB. Such databases are more than sufficient for regulators to identify trends in 
misconduct. Would the CFPB have us believe that there are so few consumer complaints that it 
needs to actively monitor consumers and companies where there have not been any problems 
found? 

As Law Professor Daniel Solove has noted, the “Framers included the warrant clause” of 
the fourth amendment, “because of their experience with general warrants and writs of 
assistance.'^ One objective of the fourth amendment is to limit the government’s ability to 
engage in “fishing expeditions”. Yet such is the very nature of the CFPB’s data collection. Is 


Daniel Soiove. 20Q2. "Digital Dossiers and the Dissipation of Fourth Amendment Privacy," Southern California 
tow Peu/etv 75:1083. 
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the CFPB's data collection limited to following up on suspected violations of the law? No, it 
covers the extensive surveillance of consumers and companies that have neither been convicted 
of a crime nor suspected of such. The CFPB, unfortunately, is another brick in the foundation of 
what ProPublica reporter .lulia Angwin has called the “Dragnet Nation”. ''' 

In reflecting on the Bank Secrecy Act of 1970, from which the third party doctrine flows. 
Justice Douglas expressed in dissenting from California Bankers Assn that he was “not yet ready 
to agree that America is so possessed with evil that we must level all constitutional barriers to 
give our civil authorities the tools to catch criminals.” I am not yet ready to agree that our 
financial markets are so possessed with evil as to merit the CFPB’s broad presumption of guilt 
on the part of all financial market participants. The manner of CFPB’s data collections are the 
result of a mindset that treats financial services providers not as citizens but as suspects. 

Nor is this level of data collection even needed to monitor our financial markets. The 
CFPB. like the general public, has access to a variety of public reports that detail, in an aggregate 
manner, trends in consumer finance. Again I would submit that the aggregate trends in housing 
and mortgage data before the crisis, while incomplete, were more than sufficient to arouse 
concern. Such trends certainly concerned me at the time. But even if the CFPB continues to 
believe that micro data is needed, it is collecting amounts far in excess of required sample sizes. 
As George Mason University Economics Professor Thomas Stratman has noted, the CFPB plans 
to collect data samples that are 70,000 times the size needed.'^ Such an expansive collection of 


Julia Angwin. 2015. Dragnet Nation: A Quest for Privacy, Security, and Freedom in a World of Relentless 
Surveillance. St. Martin's Griffin. 

See http://mercatus.org/sites/default/files/StratmannCFP8StatisticMethods.pdf 
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data reveals that the CFPB is indeed engaged in “fishing expeditions” rather than simply market 
monitoring. 

Setting aside that 1 believe both California Bankers Assn v Shultz and United States v. 
Miller to be wrongly decided, it should be noted that Miller, in finding no “expectation of 
privacy”, relies upon an analysis that “checks are not confidential communications but 
negotiable instruments to be used in commercial transactions.” True enough. Checks are 
negotiable and can be widely circulated. Yet what the CFPB collects is not limited to checks. 
Credit card transactions, for example, are not negotiable. There is no expectation that such will 
be passed along like currency. Consumers may well prefer credit (and debit) cards due to their 
relative anonymity. The data collection efforts of the CFPB (under sections 1022, 1024 and 
1025 of Dodd-Frank) go far beyond those envisioned or approved in either California Bankers 
Assn or Miller. 

Conclusions 

Chairman Duffy, Ranking Member Green, the Consumer Financial Protection Bureau’s 
data collection activities run afoul of our Fourth Amendment protections. These extensive data 
collections are in no way necessary for the CFPB to achieve its statutory mission. Such could be 
accomplished in a manner that does not offend the Fourth Amendment, while also allowing the 
CFPB to fulfill its consumer protection responsibilities. As Courts have too often been slow to 
protect our Fourth Amendment rights, it did take almost 30 years for Olm.stead to be reversed; 
Congress should move quickly to protect American consumers from harm of CFPB’s data 
collection efforts. 1 would also remind the Subcommittee that the risks deriving from the 
CFPB’s data collection efforts are also present at other financial regulators as well. 
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Good morning, and thank you for having me today. It’s an honor to be with you. 

The subject of today’s hearing is important in a narrow sense— in that we have an 
agency that is collecting more information about Americans’ private lives than any 
bureaucracy deserves for reasons unrelated to national security — but it is also 
important in a broader sense. 

Today the Consumer Financial Protection Bureau is so far outside the historic 
American model of constitutionally limited government and the rule of law, that it 
is the perfect case study of the pathologies that infect our bureaucracies at the 
federal level. 

It is dictatorial. 

It is unaccountable. 

It is practically unrestrained in expanding on its already expansive mandate from 
Congress. 

And it is contemptuous of the rights, values, and preferences of ordinary 
Americans. 

The CFPB is all of these things, as are many of our large, destructive bureaucracies 
in this city — a huge problem in its own right. 

But the CFPB is an especially good symbol of these pathologies because of its 
unique structure among regulatory agencies. In the Dodd-Frank Wall Street 
Reform and Consumer Protection Act that created the Bureau, Congress— very 
unwisely, in my opinion, gave up two of its core Constitutional powers for reining 
in executive branch agencies. 
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First, the CFPB is not subject to the annual Congressional appropriations process, 
and instead is funded out of a fixed portion of the Federal Reserve’s budget. 

And second, its director can be fired only by the president-and then only under 
limited circumstances— because Dodd-Frank made him unable to be removed by 
Congress. 

For all practical purposes, this means the Bureau is free to do whatever it wants 
within the broadest imaginable interpretation of its authority, without fear of losing 
its funding or its leadership. 

This is a very dangerous recipe for petty dictatorship, and is completely foreign to 
the American model. 

We know this formula is dangerous because we have watched the Bureau’s 
behavior over the past four years. We have seen the contempt with which it treats 
Congress and the American people. 

The CFPB is prohibited from regulating car dealers, but it has done so anyway, 
using absurdly inaccurate techniques to accuse them of racial discrimination and 
extract fines from car companies and auto finance companies. 

The topic of this hearing is another good example of the CFPB’s overreach — one I 
also discussed in my own piece in the Wall Street Journal last summer.’ 

The CFPB is prohibited in Section 1022 of Dodd-Frank from collecting personally 
identifiable information on Americans, but the Bureau is doing so anyway. And it 
is doing so at a massive scale that rivals the NSA’s most controversial collection 
programs, but for much less compelling reasons. 

The CFPB has said it aims to monitor at least 95 percent of all credit card 
transactions in the U.S. by 2016. Toward that end, the Bureau is already collecting 


’ http://wvw.wsj.com/articles/SB1 090756471 0791 284872504581 07050200449961 0 
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and analyzing data from at least 600 million credit card accounts each month. 
That’s 7 billion records in the last year alone. 

And it’s not just credit card data. The CFPB is gathering data on 22 million 
private-label mortgages every month, 5.5 million student loans, 2 million bank 
accounts with overdraft fees, and on hundreds of thousands of auto sales, credit 
scores, and deposit advance loans. 

These secretive and intrusive data-gathering operations are taking place without 
consumers’ knowledge and without the ability for consumers to opt-out. Unless 
they have been tuned into occasional Congressional oversight hearings like this 
one, consumers are entirely unaware that government bureaucrats are pouring over 
their credit card transactions every month, looking for new products to regulate. 

The CFPB is scooping up more information about law-abiding Americans than any 
government agency should be permitted to collect for reasons unrelated to national 
security or law enforcement. In fact, in a recent poll conducted by Zogby for the 
U.S. Consumer Coalition (which I happen to advise), just one in five Americans 
said they believed the CFPB should be allowed to gather credit card statements 
without consumers’ knowledge. 

For those of you who are concerned about the intelligence community’s data 
collection efforts, I don’t see how you can be worried about the potential for abuse 
and about the (in fact justified) lack of transparency in those agencies and not be 
concerned about the same dangers in this large and unaccountable bureaucracy 
armed with similar kinds of information. 

Certainly, if the NSA and the FBI need a warrant to collect such data on U.S. 
citizens for the purposes of preventing terrorism, the CFPB should need to get a 
warrant, too. 


In closing, what we have in the CFPB is an agency that is not accountable to 
Congress or to the American people, an agency that is stretching the bounds of its 
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authority as far as it can, and a bureaucracy which for all practical purposes is out 
of control. 

As the American people’s elected representatives in Congress, this should bother 
you no matter which side of the aisle you’re on, and whatever you think of the 
Bureau’s preferred regulations. 

It’s imperative that we move toward abolishing the Consumer Financial Protection 
Bureau, and at the very least subject it to the annual budgeting and appropriations 
process, in addition to restructuring its leadership, to make sure it is accountable to 
Congress. 

Thank you, and I look forward to your questions. 
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Thank you Chaii-man Duffy and Ranking Member Green for inviting me to 
testify on the Consumer Financial Protection Bureau’s use of data from financial 
institutions to inform its decisions about how best to protect American consumers. 
I’ll make three points this morning: 

First, privacy and data security are important. And there are real issues 
this Committee could be addressing if it were actually interested in the privacy and 
security of consumer data.' For example, several major data breaches have 
occurred in which individual, usable credit-card information has been stolen from 
consumers at TJ Maxx, Target, and Home Depot, among others. 

But this Subcommittee hasn’t held a single hearing on these real threats 
that can hurt actual consumers in the real world. Instead, we’re having a hearing 
about a set of imagined problems that exist only in the minds of the CBTB’s 
political opponents. In fact, if you ask the actual privacy groups, they voice support 
for the CFPB’s “acquisition and analysis of commercial databases to help it ensure 
the public is fairly treated by the financial marketplace.”'' As one privacy advocate 

' See Letter from Consumer and Privacy Groups to President Barack Obama (March 2, 2015), 
http:/^it.ly/lTOwYgJ. 

Privacy groups including Center for Digital Democracy, Consumer Watchdog, Privacy Rights 
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put it, “The reason you don’t hear from privacy or consumer groups is that the 
CFPB is not doing anything that concerns us, nor for that matter is it doing much 
differently than other regulators have always done.”^ 

Second, to the extent that it’s doing anything different, the Bureau’s 
collection of data is creating the kind of oversight and consumer protection that 
were missing before the financial crisis. The compilation of anonymous, account- 
level data from the CFPB’s credit-card database has allowed the Bureau to study 
important topics such as credit-card marketing practices, and the widespread use 
of forced arbitration clauses in consumer contracts.'" Data collection is crucial to the 
Bureau’s ability to identify systematic violations of fair-lending laws,® discrepancies 
in credit-score reporting that disadvantage consumers,’ and harmful effects of 
checking-account overdraft programs.® 

In short, the CFPB’s data collection ensures that the agency’s regulation 
and enforcement are data-driven — that is, based on the best understanding of 
market trends and empirical reality. That’s the whole point of having expert 
admini.strative agencies in the first place. Unless your profits come from deceiving 


Clearinghouse, Privacy Times, and U.S. PIRG have publicly supported the Bureau’s data collection 
programs. See Statement of Privacy and Consumer Groups In Support of CFPB’s Use of Data, July 
9, 2013, http://bit.ly/lNoLxux. 

Evan Weinberger, Data Collection Becomes Latest Front in Banks’ War on CFPB, Law 360, 

Sept. 4, 2013, http://bit.ly/lmmBJUu. 

* CFPB, The Consumer Credit Card Market (2015), httpy/l.uaa.gov/107E3uC. 

’’ CFPB, Arbitration, Study: Report to Congress Pursuant to Dodd-Frank Wall Street Reform, and 
Consumer Protection Act § 1028(a) Section 10(2015), http://l.usa.gov/lEPG8nT. 

* CFPB, Fair Lending Report of the Consumer Financial Protection Bureau (2015), 
http://l.usa.gov/lMfXFFo. 

t CFPB, The, Impact of Differences Between Consumer- and Creditor- Purchased Credit Scores: 
Report, to Congress (2011), http://l.usa.gov/lI7qlXu. 

* CFPB, CFPB Study of Overdraft, Programs (2013), httpy/1 .usa.gov/lQKOgw3. 
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consumers, you should welcome the CFPB’s data collection.® 

Third, the very existence of this hearing illustrates one danger that can 
occur when public officials don’t base their actions on data; We have a made-up 
controversy, based on made-up facts. Simply put, the CFPB is not spying on 
American citizens. It is not the NSA. It’s not interested in the details of people’s 
personal activities.'” Nor would the data that the agency is currently collecting 
enable it to investigate those activities — even if the agency were interested in, say, 
what Christmas presents you plan to buy with your credit card." 

In fact, the vast majority of the data collected by the CFPB is already 
public. For example, the Bureau has used data sets that simply aggi-egate public 
records like mortgages, already recorded in local land records, and auto sales, on 
record with state DMVs.'^ And most of it is aggregate data at the account-level, not 
at the transaction level. The CFPB’s data collection programs are designed to give 
the agency a picture of what financial institutions (not individual consumers) are 
up to— -with a focus on practices that harm consumers. Some small amounts of data 


* See Adam Levitin, The CFPB’s Data Collection Is to Be Applauded, American Banker, Aug. 18, 
2015, http;//bit.ly/lLhIjniv. 

Transaction-level information is collected rarely — to study, for example, the use of overdraft fees. 
Accounts in each case have been .scrubbed of personally identifiable information. Government 
Accountability Office, Consumer Financial Protection Bureati: Smne Privacy and Security 
Procedures far Data Collections SIwiild Continue, Report, to Contfressional Addressees 16-17 
(2014). 

" As Steven Antonakes, then the CFPB’s acting deputy director, te.stified at a July 2013 hearing 
before the Subcommittee on Financial Institutions and Consumer Credit, “The Bureau collects and 
studies data to protect con.sumers throughout the United States in accordance with its statutory 
mandate, not to study any particular individuals.” Examining How the Consumer Financial 
protection Bureau Collects and Uses Consumer Data: Hearing before the Subcomm. on Financial 
InstiMitions and Consumer Credit of the House Committee on Financial Services, 11.3th Cong. 9 
(2013), 

Adam Levitin, The CFPB ’s Data Collection Is to Be Applauded, American Banker, supra. 
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do contain information about consumers, but it is scrubbed of personal identifiers.*'* 
The Government Accountability Office, at Congress’s request, looked into 
this controversy — and, in a detailed review, found woree of the significant problems 
with data collection that the CFPB’s opponents have alleged exist. Of the twelve 
projects analyzed by the GAO, only three even potentially involved any personal 
consumer data. And, the GAO found, the CFPB has taken steps to “protect and 
secure” the data it collects, has developed a system for considering statutory limits 
and privacy implications, and has a system for “anonymizing” any material 
involving identifying information. *'* GAO’s recommendations were relatively 
minor — to establish and enhance written procedures to help ensure compliance; 
develop more comprehensive, written privacy plans and training systems; and 
improve compliance with the Paperwork Reduction Act. As Representative 
Carolyn Maloney reflected upon the study’s release: “The report puts to rest the 
idea that CFPB has been improperly using consumers’ personal financial data.”*® 
Take the credit-card space. The CFPB’s critics, to the extent they are 
trying to base their criticisms in reality, appear to be conflating three entirely 
different activities: (1) general monitoring of the credit-card market, which uses 
only account-level data on cards tied to ZIP code and geographic coding — no 
individual information at all; (2) a single study of a small number of accounts for 
the overdraft report, only 4% of which contained transaction-level data, sorted only 

'** Government Accountability Office Study, supra, at 40^2. 

Government Accountability Office Study, supra. 

Id. 

Benjamin Goad, GAO: Nothing Unusual in. CFPB Data Collection, The Hill, Sept. 22, 2014, 
http://bit.ly/llNzCsO. 
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by ZIP code — again, no individual information; and (3) supervisory and 
enforcement data that contains personal information so that, for example, the 
Bureau can locate defrauded consumers and give them back their money — 
activities entirely unconnected to the general market monitoring. 

Agencies have been collecting this same stuff for years and nobody has 
complained. The GAO’s report concluded: “Other regulators, such as the Board of 
Governors of the Federal Reserve System and the Office of the Comptroller of the 
Currency, collect similarly large amounts of data.’”' And, as Georgetown law 
professor Adam Levitin has noted, much of the data the CFPB uses is in fact 
collected through other regulatory agencies, which share this information through 
Memoranda of Understanding with the Bureau.** Which goes to show: this made- 
up controversy is really just about trying to fuel a political attack on the CFPB on 
behalf of those who benefit from less consumer protection. 

The story with the consumer complaint data is similar: The Inspector 
General did an exhaustive independent review and uncovered no major problems in 
the Bureau’s Consumer Complaint Database— a favorite punching bag of agency 
opponents. Of the 540,000 complaints in the portal, only three errors were spotted 
by a report in America, n Banker — ^titled, perhaps disingenuously, “Errors Abound 
in CFPB’s Complaint Portal.’”* The Inspector General independent audit of the 
database found only a “relatively small” number of inaccuracies in the database. Of 

'■ Government Accountability Study, supra, at 21. 

Adam Levitin, The CFPB’s Data CoUeetian Is to Be Applauded, American Banker, supra. 

Rachel Witkowski, Errors Abound in CFPB’s Complaint, Portal, American Banker, Nov. 17, 

2015, http://bit.ly/lNolQ8D, 
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the more than 250,000 complaints examined, the audit found no more than 30 
eiTors — a more than 99 percent accuracy rate.® 

Meanwhile, private industry is collecting huge amounts of data on 
consumers. The CFPB needs access to the data sets that financial institutions use, 
if it wants to effectively identify best practices and create significant safeguards 
that protect consumers. Private industry, in fact, is collecting far more personally 
identifiable data that could open up real questions about consumer privacy. The 
JPMorgan Chase Institute, for instance, recently released a report on consumer 
commerce that pulled from a data set of 12 billion individual transactions between 
consumers and businesses across 15 different U.S. metro areas. If we’re really 
worried about the collection and dissemination of this kind of data, we should be far 
more concerned about the private market that’s being created for consumer data.“ 
That could be a real regulatory issue.® With all the real problems in consumer 
finance, it’s unfortunate this Committee feels the need to hold a hearing on this 
non-issue. 

Thank you again for inviting me to testify. I am happy to answer questions. 


“ CFPB Office of the Inspector General, A-udit Report: Opportunities Erist to Enhance Controls 
Over the CFPB’s Consumer Complaint Database 13-14 (2015), http://l. usa.gov/117paNG, 

-'See Diana Farrell, Big Data to Build Sharper Profiles of CoHsum,er Commerce at the City Level, 
JPMorgan Chase Institute, Dec. 2015, http://bit.ly/ljN9FYv. 

"" This information i.s valuable — the data aggregator Yodlee, which complies consumer financial 
data, was purchased in August for nearly $690 million. Leena Rao, Why Did Yodlee Sell?, Fortune, 
Aug. 12, 2015, http://for.tn/lRniIxQ. 

® As a coalition of consumer groups pointed out, industry collection of consumer data has allowed 
financial marketers to target consumers for payday loans and higher interest rate credit cards. See 
Statement of Privacy and Consumer Groups In Support of CFPB’s Use of Data, July 9, 2013, 
http://bit.ly/lQKEudc, 
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